FourPlus Privacy Notice

1 Who we are and who is responsible

FourPlus Immersive Ltd (company number 12558660), registered at Floor 16 (JQB), Centre City Tower, 7 Hill Street, Birmingham, B5 4UA, acts as controller where it determines the purposes and essential means of processing. This includes its website enquiries, permitted website engagement profiling, service security and its own approved product improvement and anonymisation activities. The role for an XR scoring service or HPIL deployment depends on the actual processing arrangements, not solely on who designs the software.

The employer, university, college, training provider, NHS trust or other organisation that gives you access (the Customer) is responsible for its user administration, training or operational programme and its own use of records. Where FourPlus processes operational information only on the Customer’s documented instructions, FourPlus acts as a processor under a data processing agreement. Where FourPlus and a Customer jointly determine a specific purpose and essential means, they will document their joint responsibilities and make the essence available to individuals. Each deployment will identify the relevant controllers, purposes and lawful bases; contract labels do not override the factual role.

Privacy contact: privacy@fourplus.co.uk. Data Protection Officer/privacy lead: Ivan Wall, ivan@fourplus.co.uk.

2 Information collected through XR and HPIL

• Identity and account data: name, username or user identifier, organisation, role/cohort, login and authorisation status, and identifiers needed to associate an authorised person with a defined execution session.
• Protocol and execution records: module or SOP and version; steps presented, started, completed, skipped, repeated or performed out of order; prompts, warnings, confirmations, process decisions, exceptions, adaptations, recovery actions and corrective actions, where the enabled service records them.
• Hand-tracking and spatial interaction data: positions and movements of hands within the XR environment and their interactions with virtual equipment, objects and controls. These data are used to understand task execution and are not used to identify you biometrically.
• Timing data: session date/time, start and finish, duration, per-step timing, pauses and retries.
• Voice assistance data: recordings made when you use enabled voice assistance, and resulting transcripts or commands. Recordings may support service delivery and speech-to-text validation, including accuracy across accents and dialects. The approved XR design retains recordings for up to 36 months. HPIL voice collection and retention must be confirmed for the deployment. Recordings are not used for speaker recognition, biometric identification, disciplinary action or covert monitoring.
• Point of view video: approved outward-facing video from a headset or wearable device showing the task, work area and equipment. It is intended to capture execution rather than the wearer’s face, but may incidentally include other people, voices, reflections, badges, screens or documents. Capture areas, recording indicators and minimisation controls must be defined before use. Permitted purposes may include execution review and, only after effective anonymisation and governance checks, computer-vision development. Facial recognition, biometric identification, disciplinary action and covert monitoring are not permitted.
• Assessment and support data: advisory training scores where relevant to XR training; HPIL process observations, guidance requests and responses, retrieved procedural context, exception/deviation flags, explanation or evidence references, confidence indicators and human-review annotations, where enabled.
• Technical and security data: headset/device and application identifiers, software/schema versions, synchronisation, diagnostics, security and audit events.
• Support and feedback: support tickets, user feedback and related communications.
• Customer knowledge and AI inputs: approved SOPs, process documents, structured execution evidence, questions and contextual material used for customer-specific retrieval and inference. These may include personal data if the Customer supplies it; access and minimisation requirements still apply. A customer-specific dataset is not automatically anonymous.

Eye tracking is outside the currently approved XR processing scope. It will not be enabled for XR or HPIL until the relevant notice, data protection impact assessment and other required assessments have been updated and the deployment has been approved.

We do not use hand, voice, video or other execution data to identify people biometrically or to infer health, emotions, protected characteristics or general employee productivity. The services are not intended to collect patient records or other special-category information. Incidental sensitive information must be minimised, restricted and, where unnecessary, removed. Any intended processing of special-category information requires a separate documented assessment, an applicable additional legal condition and an updated deployment notice.

3 How XR and HPIL information is collected

XR software records approved events during an enabled training or execution session. HPIL is intended to bring together structured evidence from process replication and enabled capture in a physical facility, potentially including wearable devices such as smart glasses. The deployment notice will describe the actual devices, sensors, recording scope, start and stop controls, information sources and responsible organisations before collection begins. A telemetry register will specify each field, purpose, access and retention period. A general privacy notice does not authorise continuous or covert recording.

Existing XR production hosting is described in section 9. HPIL hosting, third-party AI access and the approved telemetry for each physical-facility deployment remain subject to confirmation. Staff, learners and relevant bystanders must receive appropriate information; workplace deployments must assess necessity, proportionality and whether consent would be freely given rather than assuming it.

4 Purposes and lawful bases

5 Advisory outputs and human review

XR training services may compare a session with an SOP and produce advisory scores or feedback. HPIL is intended to connect execution evidence with relevant procedures, support operators, provide missing context for quality review and inform process improvement and future automation. An HPIL observation, explanation or deviation flag is a review aid, not proof of error or misconduct. This design does not authorise solely automated decisions with legal or similarly significant effects.

• FourPlus does not permit the ledger, score or AI output to be used for disciplinary action.
• The services are not designed or authorised for covert employee surveillance, general productivity surveillance or monitoring outside the clearly defined training or operational session.
• A qualified human must interpret individual results and remain responsible for consequential training, competency, certification, progression, quality, employment or safety-related decisions. An organisation must not treat an automated result as a substitute for its professional or regulatory responsibilities.
• A reviewer must be able to inspect relevant execution evidence, the applicable procedure and available reason codes, consider missing context, challenge the model and change the proposed outcome. Where an output cannot be adequately supported, it must not be presented as a definitive finding.
• A user may challenge an inaccurate ledger entry or score and request human reconsideration.
• Where the data are incomplete or unreliable, the software should display an unscorable/low-confidence result rather than present a definitive conclusion.

6 Data protection and AI use

We protect personal and customer information through appropriate access controls and safeguards. Approved customer procedures, execution evidence, questions and related information may be used to provide authorised AI-assisted support. Where that information identifies a person, it remains subject to the purposes, access restrictions and retention arrangements described in this notice and the relevant deployment notice.

Under the approach described in this draft, only effectively anonymised information may be used to train, adapt or evaluate general or customer-specific AI models. Removing names or replacing identifiers alone does not make information anonymous. We assess whether a person could reasonably be identified and exclude information that does not meet the required standard.

Video and voice information requires particular care because people may be identifiable from their appearance, voice or the surrounding context. Any use for model development must meet the applicable anonymisation and governance requirements. Identifiable voice recordings used for speech-to-text validation remain protected personal data and are subject to the stated retention period.

Using customer information to provide an AI-assisted answer does not itself authorise its use for model training. Any proposed use of personal or pseudonymised information for model training requires a separate assessment of purpose, responsibility, lawful basis and safeguards, and an updated notice before that use begins.

7 Limits on use

• We do not sell personal data. Individual XR and HPIL operational records are not used for website advertising or sales profiling. Optional website engagement and email marketing are described separately in sections 15 and 16.
• We do not use the training ledger or score for disciplinary action.
• We do not use the system for covert surveillance.
• Under the design retained in this draft, we do not train general or customer-specific AI models directly on named or pseudonymised personal execution records. Retrieval and inference do not remove the need to protect personal data.
• We do not use hand, voice or point of view video to identify people biometrically. Wearable recording must follow the disclosed capture scope and controls.
• We do not infer health conditions, emotions, protected characteristics or general employee productivity from XR or HPIL behaviour.
• We do not enable eye tracking under the current approved processing design.

8 Who receives information

• Authorised Customer trainers, operators, quality reviewers or administrators with a relevant training or operational need and permissions appropriate to their role. Access to an individual’s information must be limited to the stated purpose.
• Authorised FourPlus personnel and contractors for the relevant service, support, security, quality, product development and approved data engineering. Website sales personnel access website enquiry and consented engagement information through the separate private dashboard.
• Amazon Web Services for the existing XR hosting arrangement, and other approved service providers under written terms. Any HPIL model/inference provider, hosted website supplier, CRM or email service must be identified and assessed before it receives personal data; the local website preview has no third-party analytics or CRM integration.
• Professional advisers, regulators, courts or law-enforcement bodies where disclosure is necessary and lawful.

Only effectively anonymised information may enter the model-training pathway described here. Operational retrieval and inference access is separately controlled. Providers must not reuse personal customer inputs for their own model training unless a separately assessed and disclosed arrangement permits that use.

9 Hosting and international access

XR and HPIL processing locations are governed by the relevant customer agreement and deployment notice. The separate customer builder and sales dashboard remain local prototypes; this website analytics launch does not publish or connect those tools.

The marketing website and its protected content editor use Sites hosting. Optional website analytics is sent directly from consenting browsers to our Matomo installation at analytics.fourplus.co.uk, hosted by Hostinger on a UK server with hosting backups in Germany. Hostinger’s data processing addendum covers subprocessors and applicable international-transfer safeguards, including Standard Contractual Clauses and the UK Addendum. These arrangements do not guarantee that all operational copies or support access remain within the UK or EEA.

If personal data is made accessible to a separate organisation outside the UK, FourPlus will assess the applicable international-transfer requirements, including overseas support access and onward transfers. Where required, safeguards may include adequacy arrangements or appropriate contractual safeguards and the relevant data protection test or transfer risk assessment. The published notice and supplier information must identify the applicable arrangement. Effectively anonymous data is not personal data, but pseudonymised data remains subject to these requirements.

The website analytics retention periods in sections 15 and 16 are separate from XR, HPIL and the local customer-builder prototype. Service-specific periods must be documented for the applicable deployment.

10 Retention

11 Security and access

• The existing XR design specifies the controls below. HPIL and hosted website controls must be verified for their respective deployments before they are described as implemented.
• For the existing XR design, UK AWS hosting with encryption in transit and at rest.
• For production service administration, Customer/tenant segregation, role-based access, least privilege and multi-factor authentication for privileged access. The local website prototype currently uses a separate password-protected dashboard; production identity, MFA, backup and encryption arrangements must be completed before live lead capture.
• Separate customer login/device allocation, identity mapping and access-control services.
• Access to personal information is restricted to authorised purposes. Only effectively anonymised information is permitted for model development under the approach described in this notice.
• Audit logging, vulnerability management, backups, recovery testing and incident procedures.
• Documented checks and approval before information is used for a new purpose.

12 Your rights

Depending on the processing and your circumstances, you may have rights to access, correct, erase or restrict personal data, object to processing based on legitimate interests, receive portable data where applicable, and obtain information about and human review of qualifying automated decisions. You may withdraw consent at any time; withdrawal does not affect the lawfulness of earlier processing. You may object to direct marketing and related profiling. Rights apply to identifiable and pseudonymised operational information, including relevant retrieval stores and website records. After effective anonymisation, information can no longer be retrieved as your personal data from an anonymous dataset.

Contact privacy@fourplus.co.uk, giving your organisation and enough context to locate the relevant session, enquiry or website visit. We will verify identity where needed and coordinate with the Customer where responsibility sits with them. For website tracking, Cookie settings lets you change your choice without contacting us. Email marketing choices are separate from tracking choices.

13 Complaints and changes

Contact FourPlus at privacy@fourplus.co.uk. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint. We will update the relevant notice before materially changing collection, wearable capture, eye tracking, permitted AI uses, sales-tracking purposes, recipients or international access. Where a change requires new consent, a notice update alone is not sufficient.

14 Children and vulnerable learners

Where software is used by children or vulnerable learners, FourPlus and the Customer will complete deployment-specific safeguarding, transparency and data-minimisation checks. Data from children is excluded from anonymous AI-development datasets by default unless a separately approved assessment supports the use and effective anonymisation is demonstrated. The website business-case tools are intended for organisational purchasing and project planning; any use aimed at children requires a separate review, including whether engagement tracking should be disabled.

15 Website enquiries and analytics

FourPlus uses optional Matomo analytics to understand visits, popular pages, navigation and approximate time spent on the public website, and to improve its content. Consent is the basis for this optional collection. You can use the website and contact us without accepting analytics.

After you allow analytics, Matomo records page paths and titles, timestamps, a random browser identifier, referring website origin, broad browser/device information and selected interactions such as solution tabs, section links, external-link domains and clicks on email links. A browser identifier does not identify your name, employer or email address. IP addresses are masked in Matomo before storage; the hosting infrastructure still receives your connection IP and may maintain operational or security logs.

We strip query strings and fragments from reported page addresses and omit referral paths and campaign parameters. We do not collect form contents, typed text, session recordings, heatmaps, or patient and operational data through this integration. Browser feature detection is disabled. Time measurements are estimates based on browser activity and focus, not proof of attention.

This analytics integration does not link visits to submitted email addresses, contact records, training records or named individuals, and does not identify visitors’ employers using their IP addresses. Email-link clicks record an interaction, not the content of any subsequent email.

The training calculator, customer business-case builder and private sales-engagement dashboard are not part of this public analytics launch. Before enabling lead capture or contact-linked visitor histories, we will explain that processing and provide any additional choices required.

When you contact FourPlus directly, we use the information you provide to handle your enquiry. This is separate from optional Matomo analytics. Website analytics is not used for decisions about individuals with legal or similarly significant effects.

16 Website cookies and your choices

The cookie banner provides equally prominent Allow analytics and Reject analytics buttons. Matomo is not loaded and no optional analytics requests or cookies are created before you allow it. Closing the banner does not grant consent. Cookie settings in the footer lets you change your choice at any time.

The necessary fp_analytics_choice cookie stores your allow/reject choice, notice version and expiry for up to 90 days, without a unique visitor identifier. A local browser-storage timestamp synchronises preference changes between tabs. If allowed, Matomo’s _pk_id cookie recognises a browser for up to 90 days, _pk_ses groups activity into sessions for 30 minutes, and _pk_ref may retain referral information for up to 90 days. These cookies apply to the FourPlus website; browsers may shorten their lifetimes.

Selecting Reject analytics stops further optional tracking and clears Matomo analytics cookies. It does not automatically delete records already collected with consent. Raw Matomo visitor records are retained for up to 90 days and aggregated reports for up to 12 months, with backups expiring according to Hostinger’s schedule. Contact privacy@fourplus.co.uk to exercise your data rights.

Analytics is restricted to public pages on fourplus.co.uk and www.fourplus.co.uk. The content editor, previews and local tools are excluded. Reports are accessible only through authorised Matomo accounts. We do not enable advertising trackers, session replay or contact-linked sales profiling in this integration.