Last Updated: September 29, 2026
At Floreo Inc. (“Floreo,” “we,” “our,” and/or “us”), your privacy is important to us. This privacy policy (“Privacy Policy”) explains what information we collect, how we use and share that information, and the choices available to you. Floreo provides proprietary digital solutions consisting of immersive virtual reality software, mobile applications, and related content delivered through our websites and services (collectively, the “Floreo Service(s)”).
This Privacy Policy applies to all Floreo Services, including products offered for educational, therapeutic, clinical, and general wellness purposes, regardless of whether they are used through schools, clinics, or direct consumer purchase. Certain Floreo Services are offered for general wellness or skill-building purposes and are not intended to diagnose, treat, cure, or prevent any medical condition unless expressly identified as a regulated medical device.
In general, users of the Floreo Services include: (i) End-users, who are typically organizations, clinicians, educators and parents that create and manage accounts for the Floreo Services, including Administrators who manage organizational accounts and End-Users who conduct supervised Learner sessions; and (ii) Learners (users of our Services (“Learners”)), who are mixed-age users that access the Services under the supervision of End-users when participating in interactive virtual reality sessions.
We take strong measures to protect any personal information you provide to us. We use established business practices and technical, administrative, and organizational security safeguards designed to keep personal information private and to ensure it is used only as described in this Privacy Policy. This policy is intended to demonstrate our commitment to transparency, responsibility, and accountability in how we handle personal information.
We promise that any personal information we collect and maintain will be: (i) used fairly and honestly; (ii) used only for specific and clear purposes and not for anything else; (iii) limited to the amount that is relevant and necessary; (iv) accurate and kept up to date; and (v) kept safe from unauthorized or unfair use and protected from accidents such as loss or damage.
This Privacy Policy applies to personal information collected, generated, or otherwise processed by Floreo in connection with the use of our Services and our websites.
The policy covers personal information relating to adult End-users, such as parents, legal guardians, educators, clinicians, authorized institutional representatives, and prospective or current customers who create accounts, manage access to the Services, communicate with us, or otherwise interact with Floreo.
This Privacy Policy also applies to personal information associated with Learners, which is collected only in connection with supervised use of the Services by children or teens under the direction of a parent, legal guardian, school, or clinic, as described in this policy.
In addition, this policy governs personal information collected from individuals who visit Floreo’s websites, including www.floreovr.com (“website”), communicate with us through our websites, or otherwise interact with Floreo outside of an active Learner session. It explains how we collect, use, and disclose such information, including through cookies and similar technologies, as further described below.
Floreo’s role with respect to personal information depends on how the Services are used.
When parents or guardians use Floreo directly at home, Floreo generally acts as a data controller and determines how and why personal information is processed in connection with the Services.
When schools, districts, clinics, or other institutional customers use Floreo, Floreo typically acts as a data processor or service provider and processes personal information on behalf of and under the instructions of the relevant institution, as set out in applicable agreements and required by law.
In healthcare contexts, Floreo may act as a Business Associate under the Health Insurance Portability and Accountability Act (HIPAA) and applicable state laws and will process Protected Health Information only as permitted by law and by the applicable Business Associate Agreement.
Certain Floreo services may be subject to regulation as digital health products or medical devices. In these contexts, Floreo may process information as necessary to support safety, effectiveness, quality assurance, regulatory compliance, and related obligations.
For purposes of this Privacy Policy, the following definitions apply.
Personal Information means information that identifies, relates to, describes, or could reasonably be linked to an identifiable individual. This may include, for example, names, contact information, account details, information about use of the Services, and, in certain contexts, health-related information.
Personally Identifiable Information (PII) means information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other information. In educational contexts, this term may include information protected under education privacy laws.
End-user means an individual who is at least 18 years of age and who has been authorized to access and use the Services, either as: (a) an Administrator who manages an organizational account and provisions other End-Users through the Floreo administrative portal; or (b) an End-User who conducts and supervises Learner sessions. All Learner access to the Services occurs under the active supervision of an End-User.
Learner means mixed-age users, including a child or teen, who uses the Services under the supervision of an End-user. For purposes of this Privacy Policy: a Child Learner means a Learner under the age of 13 (or such lower age as applicable law requires); a Minor Learner means a Learner aged 13 to 17; and an Adult Learner means a Learner who has reached the age of majority, including adults with intellectual or developmental disabilities who use the Services under the supervision of an authorized End-User.
Lesson-play metadata means information automatically generated when a lesson is played, such as lesson start and completion status, progress through content, task responses and scores, timestamps, and limited technical information required to deliver lessons and generate reports.
Protected Health Information or PHI has the meaning given under the Health Insurance Portability and Accountability Act (HIPAA) when Floreo acts as a Business Associate.
De-identified or aggregated data means data that has been processed using reasonable technical and administrative measures to remove or obscure direct and indirect identifiers such that the data cannot reasonably be used, alone or in combination with other reasonably available information, to identify or link to an individual, in accordance with applicable law. Floreo does not attempt to re-identify De-identified or Aggregated Data except as reasonably necessary to test or validate its de-identification processes or as otherwise permitted or required by applicable law.
The Services are designed for use by adults and institutions and for authorized use by children and teens in accordance with applicable law. Only adults aged 18 or older may create accounts and act as End-users.
Learners may not create accounts or use the Services independently. Learner use must occur under the authorization of a parent or legal guardian, school, clinic, or other authorized institution, as applicable. Child Learners may use the Services only where the parental consent, school authorization, or other permission required by applicable law has been obtained. The applicable authorization depends on the context in which the Services are provided, as described below.
Where a school creates or manages a Learner profile, Floreo relies on the school's authorization and representations that it has authority to provide any required consent or authorization on behalf of parents and that required notices have been provided. Where a clinic creates or manages a Learner profile, Floreo relies on the clinic's representation that it has obtained any parent, legal guardian, patient, or other authorization required by applicable law.
Certain hardware platforms or third-party services used to access the Services may impose additional age restrictions or account requirements. End-users are responsible for complying with those requirements, which are described where applicable in this Privacy Policy.
Floreo is designed to be used by children and teens only under the supervision of a responsible adult, such as a parent, legal guardian, educator, or clinician. Children may not create accounts or use the Services independently. All Learner access occurs through an adult account or through an account created by a parent, school or clinic on the Learner’s behalf.
For Floreo Services offered directly to consumers for general wellness or self-directed use, Child Learners under the age of 13 may access the Services only after Floreo has received confirmed parental consent through its email-based verification process. Floreo sends a consent request to the parent or guardian's registered email address describing the information collected, how it is used, and how consent may be withdrawn. A confirmatory response is required before any Child Learner session data is collected. No Child Learner session may commence until confirmed parental consent is received. Parents or legal guardians may withdraw consent at any time through their account settings. Withdrawal of consent is as accessible as providing it.
For parents and guardians using Floreo at home, we want to be clear about what happens when your child uses the Services. When a Learner plays a lesson, Floreo automatically collects limited information about that lesson interaction, such as whether the lesson was started or completed, progress through the lesson, task responses, scores, and the time and duration of use. This information is required to provide the Services, including progress tracking, reporting, and educational or therapeutic insights, and cannot be disabled.
Floreo does not collect Learner email addresses, phone numbers, or independent login credentials. We do not sell Learner Personal Information, use Learner Personal Information for advertising, or market directly to children. Identifiable Learner Personal Information is used only as necessary to provide and support the Services, provide reporting, comply with applicable law and contractual obligations, and for other purposes authorized by applicable law or required consent. Floreo may create and use De-identified or Aggregated Data as described in this Privacy Policy.
Certain Floreo features may include interactive content powered by generative artificial intelligence technologies. These features are optional and are not required to access or complete core lesson content.
For Learners under 13 using Floreo through a school, clinic, or other authorized organization, generative AI interactive features may be enabled where the organization has obtained, or is authorized under applicable law to provide, any parental or legal guardian consent or authorization required for the feature. Generative AI interactive features are not available for Learners under 13 on individually created Home Use accounts.
Where enabled, Generative AI Interactive Features may process audio, text, or other inputs provided during use of the Services in order to deliver the requested functionality. Floreo does not retain Audio Recordings or AI interaction transcripts in its production systems after the interaction. Floreo has configured its applicable production AI services for Zero Data Retention so that customer content submitted through Zero Data Retention-enabled services is not retained following processing. Such customer content is not used to train general-purpose artificial intelligence models. Parents or legal guardians may withdraw any consent applicable to these features at any time. Withdrawal will disable the applicable optional feature but will not affect access to non-AI lesson content.
For institutional subscribers, activation and use of generative AI interactive features are governed by the applicable enterprise agreement and data protection terms. Where consent was obtained through a school, clinic, or other authorized organization, withdrawal of consent should be directed to that organization, which will coordinate with Floreo as needed.
Certain additional features, such as surveys, feedback tools, or research participation, may also involve optional data collection and are offered on an opt-in basis where required by law.
Age Requirements for All Users. The Services are designed and intended for use by adult End-users who are at least 18 years old and for supervised use by Learners of mixed ages. Learners may not create accounts or use the Services independently. The authorization required for a Learner depends on the context in which the Services are provided and applicable law. Where a parent or legal guardian creates a Learner profile, the parent or guardian authorizes the Learner's use of the Services. Where a school, clinic, or other authorized organization creates or manages a Learner profile, Floreo relies on the organization's authority and representations regarding any required notices, permissions, or consents.
Inquiries, Registration, and Profile Information.
We may collect name, contact information, email address, and any other information provided when an individual makes an inquiry, contacts us by phone, mail, or through our websites, or signs up to receive communications. When you create an account, we collect an email address and password and may allow you to create and manage one or more Learner profiles associated with your account. When creating a Learner profile, we request a limited text identifier and the Learner’s date of birth solely for identification, age-appropriate content delivery, and reporting purposes. We do not request contact information for Learners and do not permit Learners to create independent login credentials. We do not collect Learner email addresses.
Information collected from or provided by adult End-users may include:
Floreo Mobile App Subscription. Your website subscription may also provide access to the Full Access level of our mobile apps. If you choose to download any such app and log into it using your website subscription username and password, we collect limited usage information in connection with user logins in order to monitor subscription compliance. This information is maintained in accordance with this Privacy Policy. If you have purchased your subscription in-app, we do not collect payment information directly.
Push notifications on mobile apps. We may send Floreo mobile app push notifications from time to time in order to update you on news, events, or promotions. You may turn these notifications off at the device level if you no longer wish to receive them. If you choose to receive push notifications, we collect certain device-level information, such as operating system information, device identifiers, and notification tokens, in order to ensure notifications are delivered properly. We also collect the user’s time zone, which is set on the device, to ensure notifications are sent at an appropriate time of day. We do not combine this information with other personal information.
Mobile analytics on mobile apps. We use mobile analytics software to better understand the functionality and usage of our mobile apps. This software may record information such as how often users use the apps, events that occur within the apps, aggregated usage data, performance data, and the source from which the apps were downloaded. While this information may be linked to an adult End-user account, we do not link this information to Learner profiles or to personal information submitted by Learners within the mobile apps.
While Using Certain Generative AI Interactive Content. Certain optional interactive features may process audio, text, or other information provided during an interaction in order to generate a response or otherwise provide the requested functionality. Inputs used by these features are transmitted to a contracted AI service provider solely for processing necessary to provide the interaction. Floreo does not retain Audio Recordings or AI interaction transcripts in its production systems after the interaction. Floreo has configured its applicable production AI services for Zero Data Retention so that customer content submitted through Zero Data Retention-enabled services is not retained following processing. Such customer content is not used to train general-purpose artificial intelligence models. Where Protected Health Information may be processed, Floreo maintains contractual protections required by HIPAA, including a Business Associate Agreement where applicable. These features are optional and subject to applicable authorization and consent requirements.
Portal. We may collect information pertaining to End-users’ use of our client portal, such as duration and frequency of use, and information pertaining to the device used to access the portal, including device attributes (operating system, hardware version, browser type), language, and time zone.
Device Information. We receive information from devices used to access the Services, including IP address, web browser type, mobile operating system version, phone carrier and manufacturer, application installations, device identifiers, and push notification tokens.
Technical Information. When you visit our websites, we may collect, using electronic means such as cookies, technical information. This information may include information about your visit to our websites, including the IP address of your computer and which browser you used to view our websites, your operating system, resolution, language settings in browsers, time and duration of use, device attributes (such as operating system, hardware version, browser type), language settings in browsers, time zone, third-party information such as from partner advertisers or social media sites as detailed in the Social Media section of this Privacy Policy, the site you came from, keywords searched (if arriving from a search engine), the number of page views, information you entered and advertisements you have seen. This data is used to improve the effectiveness of our websites or enhance the experience for customers. For instance, it may be used to ensure that the products advertised on our websites are available in your area or that we are not showing you the same ads repeatedly. We treat this information as personal information when it is associated with your account or contact information.
Floreo shares personal information only as described in this Privacy Policy and only to the extent necessary to provide and support the Services, comply with legal obligations, and protect users and the integrity of the Services.
With Health Professionals
Where Floreo is used in a clinical or therapeutic context, we may provide reports or records to a referring healthcare provider at the direction of the End-user or covered entity. This may include sharing reports through a client portal or other secure means to support treatment, care coordination, or healthcare operations, consistent with applicable law and any Business Associate Agreement in place.
With Schools and Clinics
When Floreo is used by schools, districts, clinics, or other institutional customers, we share information with those institutions as directed by them and in accordance with applicable agreements and laws. In these contexts, Floreo acts as a service provider or data processor with respect to identifiable Learner or patient Personal Information and does not use such Personal Information for its own independent purposes. This does not restrict Floreo's creation or use of De-identified or Aggregated Data as described in this Privacy Policy.
With Vendors and Service Providers
We may engage third-party service providers and subprocessors to perform services on our behalf, such as hosting, analytics, customer support, security monitoring, and payment processing. These providers receive only the information necessary to perform their services and are contractually required to protect the information, use it only for authorized purposes, and not disclose it to others. A list of our third-party subprocessors is available at: https://floreovr.com/privacy/third-party-subprocessors.
With Content Providers
Under certain licensing agreements, we may share video engagement, usage metrics, or similar statistics with third-party content providers. Any information shared for these purposes is provided only in aggregated or de-identified form and does not identify individual End-users or Learners.
Content Shared Within an Account
Authorized End-users may share certain curriculum or lesson-plan content with other Authorized End-users within the same organizational account. Learners cannot use the Services to make their Personal Information or content publicly available or to share information with persons outside the applicable account. Learner profiles do not include Learner-uploaded profile photographs. Any Learner display name is created and managed by the responsible adult or institution. If an End-user records a session locally using functionality on the End-user's device, that recording is stored on the End-user's device and is not received, accessed, or stored by Floreo.
De-identified and Aggregated Data
Where legally permitted, we may use and share De-identified or Aggregated Data that cannot reasonably be used to identify an individual. We may use such information for product and service improvement, analytics, benchmarking, quality assurance, safety and performance monitoring, research, publications, understanding educational or pediatric behavioral-health trends, and developing and improving Floreo products and features, including analytics and machine-learning functionality. We take reasonable measures designed to prevent re-identification of such information. We do not use Personal Information to train third-party general-purpose artificial intelligence models.
With Regulators and Oversight Bodies
We may share information with regulators or oversight bodies, including the U.S. Food and Drug Administration (FDA), the U.S. Department of Health and Human Services, Institutional Review Boards (IRBs), or similar authorities, where required or appropriate to support regulatory compliance, research oversight, safety monitoring, or audits.
As Required by Law
We may disclose information if required to do so by law, regulation, court order, subpoena, or other legally valid request. In such cases, we make reasonable efforts to disclose only the information legally required and to protect the interests of our users. We may also disclose information to protect the rights, property, or safety of Floreo, our users, or others, or to investigate and prevent fraud or misuse of the Services.
Business Transactions
In the event of a merger, acquisition, financing, reorganization, or sale of assets, personal information may be transferred as part of the transaction, subject to applicable privacy laws and appropriate protections. If a transaction is not completed, we require that any shared information be returned or deleted.
With Your Consent
We may share personal information with third parties when you provide consent or direct us to do so.
Floreo maintains administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, disclosure, alteration, or destruction. We regularly review and update our security practices to support the confidentiality, integrity, and availability of the information we process.
Information is stored and processed in secure, monitored environments. Our primary systems are hosted in data centers located in the United States, and information may be backed up to secure, off-site locations for business continuity and disaster recovery purposes.
We apply industry-standard encryption technologies to protect information in transit and at rest. Access to systems and data is restricted based on role and business need, and only authorized Floreo personnel may access personal information when necessary to provide and support the Services.
We maintain governance policies and access controls designed to ensure that information associated with each customer, school, or clinic is logically separated and that users can access only the information they are authorized to access.
Floreo follows documented procedures for secure software development, configuration management, patching, and change management. We periodically review our security controls and practices, including audits and assessments, to help maintain the effectiveness of our safeguards.
While no system can be guaranteed to be completely secure, we maintain incident response, data breach, and disaster recovery procedures designed to promptly investigate and address security incidents. Where required by law or contract, we will notify affected customers, schools, clinics, or other parties of a data breach and coordinate notification to affected individuals or families when appropriate.
Floreo may engage subprocessors or contractors that require access to personal information to perform services on our behalf. Such subprocessors are required to enter into appropriate confidentiality and data protection agreements and may use personal information only as necessary to perform the services they are engaged to provide.
Upon termination of their engagement, subprocessors are required to return or securely delete personal information in accordance with contractual requirements and applicable law.
Floreo works with schools, districts, and educational institutions to provide supervised educational and skills-based experiences for Learners. When Floreo is used in a school setting, we act as a service provider and, where applicable, as a “school official” with a legitimate educational interest under the Family Educational Rights and Privacy Act (FERPA).
Under our agreements with schools and districts, Floreo performs services that the institution would otherwise use its own employees to perform and is subject to the direct control of the institution with respect to the use and maintenance of education records. We use student data only for authorized educational purposes and do not re-disclose education records except as permitted by law or expressly authorized by the institution.
For purposes of the Children's Online Privacy Protection Act (COPPA), schools may provide authorization on behalf of parents for the collection and use of students' Personal Information where permitted by law, including when Floreo is used for an authorized educational purpose and for the benefit of the school and the information is not used for another commercial purpose. Floreo relies on the school's authorization and representations that required notices and permissions have been provided to parents where applicable.
Floreo complies with applicable state student privacy and data protection laws incorporated into our school agreements, including laws governing data security, data minimization, breach notification, and restrictions on secondary use of student data. Student data remains under the control of the school or district, and access, correction, or deletion requests are handled in accordance with the institution’s policies and applicable law.
Floreo may be used by clinics, healthcare providers, and health systems to support therapeutic, clinical, or care-related activities. In these contexts, Floreo may act as a Business Associate under the Health Insurance Portability and Accountability Act (HIPAA) and applicable state health privacy laws.
When acting as a Business Associate, Floreo uses and discloses Protected Health Information (PHI) only as permitted by law and by the applicable Business Associate Agreement (BAA) in place with the covered entity. PHI may include lesson-play data, progress information, and related reporting where such information is linked to an identifiable patient and used for treatment, healthcare operations, or related purposes.
Lesson-play information collected in clinical contexts is used to support treatment, care delivery, operational reporting, quality assurance, and system integrity. This information is required to provide the Service and support its intended clinical or therapeutic use.
Certain Floreo services may be subject to regulation as medical devices or digital health products. In these cases, Floreo may collect and retain information as necessary to support safety, effectiveness, regulatory compliance, post-market monitoring, and audit obligations. Such processing is conducted in accordance with applicable laws, regulatory requirements, and contractual obligations.
Patients, caregivers, or their authorized representatives may exercise applicable rights with respect to their information through the covered entity or as otherwise permitted by law and the applicable BAA.
This section applies only to the extent that a Learner or a parent or guardian of a Learner uses a Meta Quest device to access the Floreo Service.
Use of the Floreo Service on a Meta Quest device is subject to the terms, policies, and age restrictions imposed by Meta Platform Technologies (“Meta”). Meta’s terms prohibit the use of Meta Quest devices by children under the age of 10.
Parents or legal guardians of Learners aged 10–12 years old may create a Meta account for the Learner and permit the Learner to use a Meta Quest device, subject to Meta’s requirements. Learners aged 13 years and older may create a Meta account and use a Meta Quest device without parental consent, subject to Meta’s terms.
Floreo does not control Meta accounts or Meta’s data practices.Pico Devices. The Services may also be accessed on Pico HMD devices manufactured by Pico Technology Co., Ltd., a subsidiary of ByteDance Ltd. Use of the Services on a Pico device is subject to Pico’s own terms and data practices, which are independent of Floreo’s Privacy Policy. Floreo does not control Pico’s data collection practices. End-Users and institutional subscribers deploying Pico devices in regulated environments such as schools, clinics, or government-affiliated programs should review Pico’s privacy policy before deployment. All Learner use on Pico devices must occur under End-User supervision. To understand Meta’s data collection, use, and sharing practices, please review Meta’s Supplemental Privacy Policy and Supplemental Terms of Service, which apply upon Meta account creation and device use.
Session Recordings. The Floreo Services may include a feature that allows End-Users to create recordings of Learner responses and interactions during supervised VR sessions. Session Recordings are stored solely on the End-User's device and are not transmitted to or stored on Floreo's systems. Floreo does not receive, access, or process Session Recordings. End-Users are solely responsible for the lawful use, storage, and handling of Session Recordings, including compliance with applicable recording consent laws and any professional, clinical, or educational obligations. For information about your rights with respect to Session Recordings, please contact your institution or the End-User who created the recording. When you visit our websites or use our applications, we may use cookies and similar technologies to operate the Services, enhance functionality, and understand how the Services are used. Cookies are small text files stored on your device that allow us to recognize your browser or device.
We use cookies and analytics tools primarily to support core functionality, security, performance monitoring, and aggregated usage analysis. These tools help us understand which features are used, identify technical issues, and improve the overall user experience.
Floreo does not use cookies or tracking technologies to engage in behavioral advertising based on Learner data. We do not use Learner data for targeted advertising, and we do not sell personal information.
Where required by law, you may be given choices regarding the use of certain non-essential cookies. You may also adjust your browser or device settings to manage cookies; however, disabling cookies may limit certain features of the Services.
For individuals located in the European Economic Area or the United Kingdom, Floreo processes personal data only where a lawful basis applies.
We process information required to deliver lessons and generate reports on the basis of performance of a contract. This includes lesson-play metadata and related reporting information that is necessary to provide the Service requested by the user or institution.
We process certain information on the basis of our legitimate interests, such as maintaining the security and integrity of our systems, preventing fraud or misuse, ensuring service reliability, and improving our Services, provided that these interests are not overridden by the rights and freedoms of individuals.
Where required by law, we rely on consent for optional features, such as certain enhanced analytics, generative AI interactions, or audio or video recordings. Consent may be withdrawn at any time, subject to legal or contractual limitations, and withdrawal may limit access to the specific optional feature but not core lesson functionality.
When processing special categories of personal data, such as health-related information, we rely on explicit consent, processing necessary for the provision of health or social care or treatment, or other lawful bases permitted under applicable data protection laws, including processing under a Business Associate Agreement or similar contractual framework. Consent Withdrawal. Where Floreo processes personal data on the basis of consent, you may withdraw consent at any time. Floreo provides a withdrawal mechanism that is no less accessible than the mechanism used to give consent. For consumer accounts, withdrawal is available through account settings. For institutional accounts, Administrators may manage consent status through the Floreo administrative portal. Withdrawal: (a) applies prospectively and does not affect the lawfulness of processing carried out prior to withdrawal; (b) does not require deletion of data retained under a separate lawful basis such as contractual necessity or legal obligation; (c) does not affect data that has been genuinely anonymized such that re-identification is not reasonably possible; and (d) does not restrict access to core Service functionality that is not dependent on the consented processing. Consent withdrawal is distinct from the right to erasure, which is a separate right exercised as described in Your Rights and Choices below.
When Floreo acts as a data processor for schools or clinics, we process personal data only on the documented instructions of the relevant controller and in accordance with applicable contracts and data protection laws. Where Floreo acts as a controller, the applicable lawful basis depends on the processing context and may include performance of a contract, legitimate interests, consent, or compliance with a legal obligation, as permitted by applicable law. Where processing involves special categories of personal data, an additional condition under Article 9 of the GDPR or UK GDPR must also apply.
Floreo is headquartered in the United States, and personal information may be processed and stored in the United States or other countries where Floreo or its service providers operate.
For individuals located in the European Economic Area or the United Kingdom, we implement appropriate safeguards for international transfers of personal data, including the 2021 Standard Contractual Clauses approved by the European Commission for transfers from the EEA, and the International Data Transfer Agreement (IDTA) approved by the UK Information Commissioner's Office for transfers from the United Kingdom, or other lawful transfer mechanisms as required by applicable law.
Our subprocessors are required to adhere to equivalent data protection and security standards, and onward transfers are subject to contractual safeguards.
We retain personal information only for as long as necessary to provide the Services, fulfill the purposes described in this Privacy Policy, comply with legal or regulatory obligations, resolve disputes, and enforce our agreements.
Lesson-play data and related reporting information are retained in accordance with service requirements, contractual obligations with schools or clinics, and applicable laws. Retention periods may vary depending on how the Services are used and the applicable regulatory context.
When personal information is no longer required, it is securely deleted, anonymized, or de-identified in accordance with our data retention and destruction policies.
Children's Personal Information is retained only for so long as reasonably necessary for the specific purpose for which it was collected and is deleted or de-identified when the applicable retention period expires, subject to legal or regulatory obligations requiring continued retention. Audio Recordings and AI interaction transcripts processed through Floreo's Zero Data Retention-enabled AI services are not retained following processing.
Certain Floreo Services may be subject to medical device or digital health regulations. Where Floreo provides a regulated medical device product, we may retain certain information for periods required by applicable law or regulation, including to support product safety, quality management, adverse event reporting, post-market surveillance, and regulatory compliance. These retention obligations may override a general request for deletion where required by law.
Floreo implements administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, loss, misuse, or alteration.
These safeguards include access controls, encryption of data in transit and at rest, secure system architecture, regular monitoring, and periodic security assessments. Access to personal information is limited to authorized personnel who require it to perform their job responsibilities.
While we strive to protect personal information, no system can be guaranteed to be completely secure.
Floreo maintains incident response and breach notification procedures designed to promptly investigate and respond to suspected security incidents.
In the event of a data breach involving personal information, we will notify affected customers, schools, clinics, or other relevant parties as required by law or contract. Where appropriate, we will coordinate with institutions to support notification to affected individuals or families.
Parents and guardians may request access to, correction of, or deletion of their child's personal information at any time, subject to applicable law and any required retention obligations. For Learner accounts created for Home Use, requests may be submitted to privacy@floreovr.com. For Learner accounts created by a school, clinic, or other authorized organization, requests should be directed to that institution, which will coordinate with Floreo as needed to fulfill the request. Parents and guardians may also withdraw consent previously provided or request that Floreo stop further collection or use of their child's personal information, subject to applicable law. We may take reasonable steps to verify the requester's identity and authority to act for the Learner.
Adult account holders may access and update certain account information through their account settings and may contact us for additional requests. Please note that certain information may be retained as required by applicable law, including requirements related to regulated medical device products.
Individuals located in the European Economic Area or the United Kingdom have rights under the GDPR or UK GDPR, including the right to access, rectify, erase, restrict, or object to processing of personal data, and the right to data portability, subject to applicable limitations.
California and other U.S. state residents may have additional rights under applicable privacy laws, including the right to request access to or deletion of personal information, subject to verification requirements and legal exceptions.
Where applicable, individuals may submit requests through the contact information provided below. We may need to verify the requester’s identity to protect privacy and security. We do not sell personal information and do not discriminate against individuals for exercising their privacy rights.
The Floreo Services are operated from the United States. If you access or use the Services from outside the United States, please be aware that your personal information may be transferred to, processed, and stored in the United States or other jurisdictions where Floreo or its service providers operate.
Data protection laws in these jurisdictions may differ from those in your country of residence. Where required by applicable law, we implement appropriate safeguards to protect personal information transferred internationally, as described in this Privacy Policy.
The Services may contain links to third-party websites, platforms, or services that are not owned or controlled by Floreo. This includes, for example, hardware platforms, app stores, or external content providers.
Floreo is not responsible for the privacy practices, content, or data handling practices of third parties. We encourage you to review the privacy policies and terms of service of any third-party services you access in connection with the Floreo Services.
This Privacy Policy applies only to information collected by or on behalf of Floreo.
We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or business operations.
When we make material changes to this Privacy Policy, we will post the updated version on our website and, where appropriate, provide additional notice through the Services or by other reasonable means. Where required by applicable law, including where a material change affects the collection, use, or disclosure of a child's Personal Information covered by prior consent, Floreo will provide direct notice and obtain any required new consent before applying the changed practice. The “Last Updated” date at the top of the Privacy Policy indicates when it was most recently revised.
Your continued use of the Services after an updated Privacy Policy becomes effective constitutes acceptance of the revised policy, to the extent permitted by law.
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, you may contact us at:
Floreo Inc.
5425 Wisconsin Avenue, Suite 600
Chevy Chase, MD 20815, USA
Email: privacy@floreovr.com
Phone: +1 (240) 244-9473
If you wish to report a security concern or suspected data breach, please contact us at:
Email: security@floreovr.com
Floreo Inc.
5425 Wisconsin Avenue, Suite 600
Chevy Chase, MD 20815, USA
Email: info@floreovr.com
Pursuant to Article 27 of the General Data Protection Regulation (“GDPR”), Floreo has appointed GDPR Local Ltd. as its Data Protection Representative in the European Union. Individuals located in the European Union may contact the representative directly regarding all requests related to data protection and privacy matters:
GDPR Local Ltd.
Email: contact@gdprlocal.com
Pursuant to Article 27 of the UK GDPR, Floreo has appointed GDPR Local Ltd. as its UK Representative. You may contact them directly regarding all requests related to data protection and privacy matters at:
GDPR Local Ltd.
1st Floor Front Suite
27–29 North Street
Brighton
England
Email: contact@gdprlocal.com
Tel: +44 1772 217800
• On February 25, 2020, to update privacy and security procedures and to describe FERPA compliance for school customers in various states.
• On July 7, 2020, to update privacy and security procedures to include compliance with Canadian FIPPA privacy requirements.
• On March 21, 2022, added the ability to request deletion of collected data.
• On May 22, 2024, to update managing information preferences, software and hardware descriptions, technical information, descriptions of data collected, data retention processes, FERPA notice requirements, and California CCPA compliance requirements, and to align with the iKeepSafe Safe Harbor Program.
• On October 30, 2024, to add details regarding how information is collected and shared when using optional generative AI interactive content.
• On January 17, 2025, to clarify that websites and Services are for account holders over 18 years of age and that intended use involves supervised or coached experiences with mixed-age Learners.
• On November 18, 2025, to add information regarding GDPR and UK GDPR rights and procedures and to rephrase sections describing how information is used to improve readability.
• On January 2, 2026, to comprehensively restructure and rewrite the Privacy Policy to support use by parents at home, schools, clinics, and direct-to-consumer users; clarify required versus optional data collection (including lesson-play metadata); address parental consent requirements for children under 13; align with EU and UK GDPR requirements; and support current and future general wellness, digital health, and regulated medical device offerings.
• On August 18, 2026, to clarify Child Learner and institutional authorization requirements; update Generative AI Interactive Feature disclosures to reflect Zero Data Retention and applicable contractual protections; clarify De-identified or Aggregated Data practices and sharing controls; and update parental rights and retention disclosures.
• On September 29, 2026, to clarify the consent pathway and availability of Generative AI Interactive Features for Learners under 13 and to clarify how parents and guardians may submit access, correction, and deletion requests.
© Copyright 2026 Floreo