App and product browser — privacy policy

This privacy policy gives information on how we collect and process personal data in connection with our App or browser-based training platform.

Our App and browser-based training platform are not intended for children and we do not knowingly collect data relating to children.

Please read this privacy policy together with any other privacy policy or fair processing policy we may provide on specific occasions when we are collecting or processing personal data about you, so that you are fully aware of how and why we are using your data.

The Virti Group is made up of VirtiHealth Ltd and Virti Inc. This privacy policy is issued on behalf of the Virti Group, so when we mention “we”, “us” or “our” in this privacy policy, we are referring to the relevant company in the Virti Group responsible for processing your data.

We have appointed a data privacy manager. You can contact our data privacy manager at privacy@virti.com or by writing to VirtiHealth Ltd, 1 Brassey Road, Old Potts Way, Shrewsbury, Shropshire, SY3 7FA.

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

We collect, use, store and transfer different kinds of personal data about you in connection with the App and the browser-based training platform, including account, identity, contact, technical, usage and training-performance data.

We do not collect any Special Categories of Personal Data about you, nor do we collect information about criminal convictions and offences.

We collect data through direct interactions when you create an account, configure training content or use the platform; through automated technologies such as device identifiers, session metadata and analytics; and from your organization, where you have been provisioned an account by an administrator.

We use your personal data to provide and improve the Virti platform, to deliver training and learning experiences, to provide analytics to your organization, and to fulfil our contractual obligations to your employer or organization.

Customer data is not used to train or fine-tune global AI models. AI interactions are processed via stateless API calls, and customer inputs are excluded from model provider training sets by default.

We may share your personal data with companies in the Virti Group, your organization’s administrators, and selected service providers — such as cloud-hosting and AI-inference providers — who are bound by contractual obligations to protect your data.

We may transfer your personal data outside of the UK or European Economic Area to other Virti Group entities and to selected service providers. Where we do, we ensure a similar degree of protection by using approved contractual safeguards.

We have put in place appropriate security measures aligned with our ISO 27001 certification to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.

Retention periods are configurable based on your organization’s contractual arrangement. Upon contract termination, all customer data is permanently deleted within 60 days.

Under data protection laws you have rights in relation to your personal data, including the right to request access, correction, erasure or restriction of processing.

If you wish to exercise any of these rights, please contact our data privacy manager at privacy@virti.com.