About Waven
Waven is a Swiss company. We developed Waven Access and we are responsible for this service, including how your data is stored and protected.
What data we collect
We collect only what is necessary to provide the remote VR control service. Here is exactly what we store:
- Access information: Your tenant ID, hashed session identifiers, and login timestamps. We verify access tokens but do not store them in readable form.
- Device information: Headset ID, device name, model, app version, connection times, player state, screen size, and online status.
- Session and usage information: During a live session, playback state and video URLs are processed in memory. At session end, we retain device-linked playback sessions with UTC calendar days and durations, including the day and watch duration of each play, but no time of day, video URL, or title. Weekdays are derived from the dates. Separate weekly and monthly usage summaries and per-video play aggregates remain unlinked to sessions or devices; video URLs are retained only as keys in those aggregates.
- Your settings: Language preference, saved video URLs and categories, survey URL, and your last selected device.
- Security and technical logs: Authentication events, rate-limiting information, and system events needed to protect and operate the service securely.
How we use your data
We use your data to:
- Authenticate you and your devices securely
- Send and receive remote control commands
- Restore your device state between sessions
- Display usage statistics and video play aggregates
- Enable you to export or delete your data
- Prevent abuse and diagnose technical issues
- Maintain service security
We process your data based on contract necessity to provide the service, and on legitimate interest to monitor and improve it and to maintain its security.
If you are a healthcare institution using Waven Access with patients, you are the controller of your patients' data: we process it on your documented instructions as your processor, under a data processing agreement. You are responsible for informing your patients; we provide accurate technical descriptions on request.
How long we keep your data
Day-only playback sessions, weekly and monthly usage summaries, and per-video play aggregates are automatically deleted after 2 years. Expired session days and aggregate periods are removed daily and at service startup. Only the separate per-video aggregates include video URLs.
You can export or delete your playback sessions and usage and video aggregates at any time from the My Data page.
Login sessions expire automatically. Security logs (login attempts and lockouts, with a pseudonymised network address) are kept for 12 months and device connection logs for 30 days. Records of changes to account settings and devices, and of data export and deletion requests, are kept for 6 years as proof of accountability; they contain no patient information, video information or free text. Backups are managed under a separate retention schedule.
Your data rights
You are in control of your data. Depending on your local laws, you may have the right to access, correct, export, restrict, object to, or delete your personal data, and to file a complaint with a data protection authority.
With Waven Access, you can directly:
- View all your data on the My Data page
- Export your usage statistics and video play aggregates as a JSON file
- Delete your usage statistics and video play aggregates at any time
Security
We take security seriously. Waven Access uses:
- Tenant-scoped authorization to isolate your data
- Hashed server-side sessions
- CSRF and WebSocket origin protection
- Login throttling and input validation
- Encrypted HTTPS transport in production
- Unprivileged application container
While we implement strong security measures, no system can guarantee absolute security.
Contact us
If you have any questions about this privacy notice or how we handle your data, contact us at:
Changes to this notice
This notice may be updated when the service or its data practices change. The effective date above identifies the current version.