Last Updated: October 30, 2024
Introduction
At Floreo Inc. (“Floreo,” “we,” “our,” and/or “us”), your privacy is important to us. In this privacy policy (the “Privacy Policy”), we tell you what information we collect, share with others, and how we use it. Floreo provides proprietary digital solutions consisting of immersive virtual reality software, mobile applications and content (collectively, the “Services”) to users (users of our Services (“Learners”), and their parents, organizations or clinicians who are the account holders which may have purchased the Services are hereinafter collectively referred to as “End-users”). We want you to know that we take strong measures to keep any personal information you give us safe. We use strict business rules and strong security methods to make sure your personal info stays private and is only used for what we say in this Privacy Policy. This policy is meant to show you that we are responsible and clear about how we handle personal information. We promise that any personal info we collect and keep will be: (i) used fairly and honestly; (ii) only used for specific and clear reasons, not for anything else; (iii) just the right amount and related to what's needed; (iv) accurate and kept up to date; and (v) kept safe from unauthorized or unfair use, and protected from accidents like losing or damaging it.
Application and Scope of this Privacy Policy
This Privacy Policy generally applies to any personal information (as defined below in the section entitled Definition of Personal Information) collected or generated by Floreo from or about our End-users and other individuals with whom we deal, which may include potential customers. This Privacy Policy also governs personal information collected about Floreo websites’ users and explains how we use and disclose personal information that we collect from people who visit our websites and otherwise interact with us through any of our websites associated with our domains: Floreo.com (such as www.floreovr.com (“website”)). It also explains how we use cookies and similar technologies.
Definition of Personal Information
In this Privacy Policy, personal information means “any information about an identifiable individual”. This can include, for example, our End-user’s names, contact information, email addresses, account details, services used, and End-user’s health condition (sometimes in school settings called “Personally Identifiable Information” (“PII”)). It might also include technical details like IP addresses or browsing history (pages accessed, date and location of access), but only when this information can identify an individual. Personal information that is combined and where personal information has been de-identified and removed and can't be traced to a specific individual (“Anonymous Information”) is not treated as personal information.
In some cases, we might be considered a Business Associate under the Health Insurance Portability and Accountability Act (“HIPAA”) for certain Covered Entities (as defined under HIPAA), and this means that we may have specific rules on how we use your Protected Health Information (“PHI”). When acting as a Business Associate, we can only use or share your PHI or personal information as required by law or allowed by a special agreement (called a Business Associate Agreement) with a specific healthcare organization. Please be aware that when you give other individuals access to your PHI or personal information, they may be able to use, reproduce, distribute, display, transmit, and/or communicate the data to others and the public. We shall not have any responsibility for access, use, or disclosure of your PHI or personal information by people you authorized to have access to your user account.
When acting as a Business Associate, we may only use or disclose your PHI or personal information as required by law or as permitted by the Business Associate Agreement (“BAA”) that we have in place with a specific Covered Entity. Please be aware that when you give other individuals access to your PHI or personal information, they may be able to use, reproduce, distribute, display, transmit, and/or communicate the data to others and the public. We shall not have any responsibility for access, use, or disclosure of your PHI or personal information by people you authorized to have access to your user account.
Managing your Information Preferences
You may opt out of receiving marketing e-mails from us by using the unsubscribe link in the
relevant email. If you have questions regarding this Privacy Policy, please e-mail us at privacy@floreovr.com.
Information We Collect
Information You Provide to Us
We collect most of our information directly from our End-users (in many cases through our service provider users), with their consent, or with the consent of their parents (for End-users which have not reached the age of majority in their place of residence). In many cases, we collect the following types of information:
Inquiries, Registration and Profile Information. We may collect the name, contact information, e-mail address and any information provided to us upon someone making an inquiry or contacting us by phone, mail, or through our websites or upon an individual signing up to receive our newsletter. When you sign up for an account, we ask you for your email address and password. Once you create an account, you will be able to create one or multiple Learner accounts associated with your account. When you create a Learner account, we ask you to insert a text identifier that will be used to identify the Learner, as well as the Learner’s birth date. We do not request other PII information for Learners using the accounts. We do NOT collect Learner emails or addresses, only the adult End-users who create the individual Learner accounts. Other information collected may include the following:
Payment Information. We may collect information when End-users purchase and use our Services. If you sign up for a subscription, your payment information, such as any credit or debit card information you provide, may be collected and stored by us and/or the payment processors with which we work.
Communications. If you contact us directly, we may receive additional information about you. For example, when you contact customer support, we may receive your name, email address, phone number, the contents of the message and/or attachments you may send us, and any other information you may choose to provide. When we send you emails, we may track whether you open them to learn how to deliver a better customer experience and improve our Services. Certain features we offer include an option to provide us with feedback. The feedback feature does identify the customer account email but does not identify the specific Learner submitting it. The feedback option is voluntary and the information a Learner submits to us will only be used for improving these features. If we receive PII through a feedback form we take steps to immediately delete that information.
Information We Collect When You Use Our Services
Floreo Mobile App Subscription. Your website subscription may also provide access to the Full Access level of our mobile apps. If you choose to download any such app and log into it with your website subscription username and password, we collect limited usage information in connection with user logins in order to monitor subscription compliance. This information is maintained in accordance to this policy. If you have purchased your subscription in-app, we do not collect any user information.
Push notifications on mobile apps: We may send Floreo mobile app push notifications from time to time in order to update you on news, events, or promotions. You may turn these notifications off at the device level if you no longer wish to receive them. If you choose to receive push notifications, we will need to collect certain information about your device - such as operating system and user identification information - in order to ensure they are delivered properly. We also collect the user time zone, which is set on the device, to ensure that we send notifications at an appropriate time of the day. We do not combine this information with other PII.
Mobile analytics on mobile apps: We use mobile analytics software to allow us to better understand the functionality of our mobile apps' software on your phone. This software may record information such as how often you use the apps, events that occur within the apps, aggregated usage, performance data, and from where the apps were downloaded. While this information does link to the customer email address, we do not link this information to any Learner PII you submit within the mobile apps.
While Using Certain Generative AI Interactive Content. If you opt in to using certain interactive content, such as content using generative AI technology, you may provide us with your audio recordings (“Audio Recordings”) or any text, video or images that you upload and provide us in the context of the Services. If you provide Audio Recordings, this may contain the Personal Information of third parties. Before you do so, please make sure you have the necessary permission of such third parties before sharing Personal Information. As used herein, third parties include anyone other than the subscription holder, such as a Learner or anyone else who may be present during the use of the Services. If you provide Audio Recordings, Floreo may convert such Audio Recordings to transcripts. We may train our technology on de-identified transcripts or text you provide to create lesson recommendations or more accurate or personalized Services.
Portal. We may collect information pertaining to the End-users’ use of our client portal, such as time and duration of use information pertaining to the device used to access the portal, such as device attributes (operating system, hardware version, browser type), language and time zone.
Device Information. We receive information from devices, including IP address, web browser type, mobile operating system version, phone carrier and manufacturer, application installations, device identifiers, and push notification tokens.
Website and Social Media
Technical Information. When you visit our websites, we may collect, using electronic means such as cookies, technical information. This information may include information about your visit to our websites, including the IP address of your computer and which browser you used to view our websites, your operating system, resolution of screen, location, language settings in browsers, time and duration of use, device attributes (such as operating system, hardware version, browser type), language settings in browsers, time zone, third party information such as from partnered advertisers or social media sites as detailed in the Social Media section of this Privacy Policy, the site you came from, keywords searched (if arriving from a search engine), the number of page views, information you entered and advertisements you have seen. This data is used to measure and improve the effectiveness of our websites or enhance the experience for our customers. For instance, it may be used to ensure that the products advertised on our websites are available in your area or that we are not showing you the same ads repeatedly. We treat this information as personal information when it is associated with your account or contact information. For instance, we may collect and use the following type of information when you visit and/or interact with us on our websites:
We do not collect customer’s web search history across third party websites or search engines. However, if a customer navigates to our website via a web search, their web browser may automatically provide us with the web search term they used in order to find us. Our website does not honor "do not track" signals transmitted by users' web browsers, so we encourage you to visit the following link if you would like to opt out of certain tracking: http://www.networkadvertising.org/choices or http://www.aboutads.info/choices/. Note that if you wish to opt out, you will need to do so separately for each of your devices and for each web browser you use (such as Internet Explorer®, Firefox®, Safari®).
How We Use the Information We Collect
We use the information we collect from End-users and Learners to:
If you apply for employment with Floreo, the personal information submitted with your job application will be used for recruitment and other customary human resources purposes. For example, we may send you information about new job opportunities within Floreo as well as other career development resources.’
Unless required or authorized by law, Floreo will not collect or use personal information for any other or new purpose without obtaining further consent. For details on how we use information collected via our websites, please refer to the Website and Social Media section of this Privacy Policy.
How We Share the Information We Collect
Health Professionals. We may provide your referring healthcare provider with copies of your records or reports that will assist them in your treatment and healthcare during your treatment or after you have completed your treatment using our Services if you have instructed us to do so, either through our client portal where you can request an email report which you can then share with your healthcare professional, or through other means.
Vendors and Third-party Affiliated Service Providers. We may hire service providers, which may be Business Affiliates, to perform services on our behalf. This may include, without limitation, a person or an organization retained by Floreo to perform work on its behalf. We provide them with a limited amount of information which is necessary in order for them to provide the services required. They are prohibited from using the information for purposes other than to facilitate and carry out the services they have been engaged to provide. These service providers are not permitted to disclose this information to others. A list of our third-party subprocessors can be found at https://floreovr.com/privacy/third-party-subprocessors.
Content Providers. We may be required, under the licensing agreements that we have with third party content providers, to share video engagement and usage metrics and statistics, although the information shared with such content providers will, at all times, be provided on an aggregate level, and will never identify an End-user on an individual basis.
Learner Content. We may provide End-users the ability to share content, such as Learner-driven curriculum or recorded sessions, at their direction. If you choose to share your information and/or content with other End-users, your profile information, such as your profile photo, may be visible to those End-users.
De-identified and Aggregated Data. Where legally permissible, we may share information about End-users with our partners in aggregated or de-identified form that can’t reasonably be used to identify you or your End-users. This means we may redact or remove the personal information that could be used to identify you like your name and contact information, and use the remaining non-personal, de-identified data to aggregate and analyze it for business or other legitimate purposes such as product and Service improvements, research, publications and documents, and to help us better understand pediatric behavioral health issues and patient populations. Before sharing this information with third parties, any resulting research or analyses will be de-identified and aggregated in a form that is designed to prevent anyone from identifying you.
Regulators. We may share any information we receive with the U.S. Food and Drug Administration (“FDA”) and similar agencies in the U.S. and other countries and the U.S. Department of Health and Human Services, with the Institutional Review Board (“IRB”) and other groups that review research studies to help protect people who join these studies.
As Required By Law and Similar Disclosures. From time to time, Floreo may be compelled to disclose personal information in response to a law, regulation, court order, subpoena, valid demand, search warrant, government investigation or other legally valid request or enquiry. In these circumstances, Floreo will protect the interests of its End-users by making reasonable efforts to ensure that orders or demands comply with the laws under which they were issued, that it discloses only the personal information that is legally required and nothing more, and that it does not comply with casual requests for personal information from government or law enforcement authorities. We may also disclose information to our accountants, auditors, agents and lawyers in connection with the enforcement or protection of our legal rights. We also reserve the right to report to law enforcement agencies any activities that we, in good faith, believe to be unlawful or to law enforcement and emergency services providers, in an emergency or where required or permitted by law. We may release certain personal information when we have reasonable grounds to believe that such release is reasonably necessary to protect the rights, property and safety of others and ourselves, in accordance with or as authorized by law. We may access, preserve, and disclose your information if we believe doing so is required or appropriate to (a) comply with law enforcement requests and legal process, such as a court order or subpoena; (b) respond to your requests; or (c) protect your, our or others’ rights, property, or safety. For the avoidance of doubt, the disclosure of your information may occur if you post any objectionable content on or through our Services.
Business Transaction. We may disclose personal information to a third party or potential transactional partners in connection with consideration, negotiation, or completion of a corporate transaction in which we are acquired by or merged with another company or a sale or transfer of business or assets, an amalgamation, re-organization or financing of parts of our business. However, in the event the transaction is completed, your personal information will remain protected by applicable privacy laws. In the event the transaction is not completed, we will require the other party not to use or disclose your personal information in any manner whatsoever and to completely delete such information.
Consent. We may also disclose your information with your permission.
Information We Do NOT Collect or Use.
How We Store and Process Your Information
We strive to maintain security policies and procedures that are designed to protect your information.
Our servers are located in a secured, locked, and monitored environment to prevent unauthorized entry or theft, and are protected by a firewall. The servers are located in a data center in the United States and backed up daily to a secure, U.S.-based, off-site data center.
While we do actively collect PII, we take extra measures to ensure the safety of Learner data and apply a Secure Sockets Layer (SSL or HTTPS) encrypting technology to establish and ensure that all data passed between the server and the browser remains encrypted. Data stored in our databases is encrypted at rest as well.
Governance policies and access controls are in place to ensure that the information of each customer, school, or other subscriber is separated, and all subscribers can only access their own data.
Only limited Floreo personnel have access to the database, and personnel only access it when necessary to provide services.
We follow standardized and documented procedures for coding, configuration management, patch installation, and change management for all applicable servers, and we audit our practices at least once a year.
While we strive to maintain best industry-standard privacy and security practices, it should be noted that no industry system is fail proof. We have established a Data Breach Policy and Disaster Recovery Plan to swiftly address any potential data breaches, losses or disasters. In the event of a data breach, our policy includes a thorough investigation to determine the extent of the breach and the nature of the data compromised. We are committed to promptly notifying the affected subscriber(s), and when appropriate, coordinating with them to support notification of affected individuals, Learners, and families when there is a substantial risk of harm from the breach or a legal duty to provide notification. Our goal is to ensure transparency, mitigate potential risks, and uphold the privacy and security of our End-user’s data.
Data Retention.
We will retain your information only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use your information to the extent necessary to comply with our legal obligations, resolve disputes, and enforce our legal agreements and policies.
Subcontractors.
Subcontractors’ with access to Learner data information are required to sign Non-Disclosure Agreements and must return or destroy all Floreo property and data at the end of their contracts.
Data Breach Protocol.
Floreo maintains a contact list of key administrators for each End-user. Should a data breach occur, these administrators will be notified via email as soon as it is known what breach, exposure or data loss may have occurred.
Your Choices
Sharing Preferences. Within our portal, we provide you with settings to allow you to set your sharing preferences for content you post to our Services. To change whether certain information is publicly viewable, you can adjust the settings in your account.
Email Subscriptions. You can unsubscribe from our promotional emails via the link provided in the emails. Even if you opt-out of receiving promotional messages from us, you will continue to receive administrative messages from us.
Right to Know and Delete. You have the right to know certain details about our data practices. In particular, you may request the following from us:
In addition, you have the right to delete the personal information we have collected from you. To exercise your right to know, please send an email to: privacy@floreovr.com.
In the request, please specify whether you are seeking the categories of information we collect or the specific pieces of personal information. To delete your account, please send an email to: help@floreovr.com. Please note that while any changes you make will be reflected in active user databases instantly or within a reasonable period of time, we may retain all information you submit for backups, archiving, prevention of fraud and abuse, analytics, satisfaction of legal obligations, or where we otherwise reasonably believe that we have a legitimate reason to do so.
We will confirm receipt of your request within 10 days. We may require specific information from you to help us verify your identity and process your request. If we are unable to verify your identity, we may deny your requests to know or delete.
California Residents. The California Consumer Privacy Act (CCPA) provides that California consumers with the right to request access to their personal data, additional details about our information practices and deletion of their personal information (subject to certain exceptions). California consumers also have the right to opt out of sales of personal information, if applicable. We describe how California consumers can exercise their rights under the CCPA below. Please note that you may designate an authorized agent to exercise these rights on your behalf by providing written materials demonstrating that you have granted the authorized agent power of attorney. Please note that if an authorized agent submits a request on your behalf, we may need to contact you to verify your identity and protect the security of your personal information. We will not fulfill your CCPA request unless you have provided sufficient information for us to reasonably verify you are the consumer about whom we collected personal information. We will not discriminate against you if you choose to exercise your rights under the CCPA.
You may request, no more than twice in a twelve (12) month period, access to the specific pieces of personal data we have collected about you in the last twelve (12) months. You may also request additional details about our information practices, including the categories of personal information we have collected about you, the sources of such collection, the categories of personal information we share for a legitimate business or commercial purposes, and the categories of third parties with whom we share your personal information. You may make these requests by contacting using the contact information provided below in the “How to Contact Us” Section below. After submitting your request, please monitor your email for a verification email. We are required by law to verify your identity prior to granting access to your data in order to protect your privacy and security.
You may request, no more than twice in a twelve (12) month period, transportable copies of your personal information that we have collected about you in the last twelve (12) months. You may make these requests by contacting using the contact information provided below in the “How to Contact Us” Section. After submitting your request, please monitor your email for a verification email. We are required by law to verify your identity prior to granting access to your data in order to protect your privacy and security.
You may request that we delete the personal information we have collected about you. Please note that we may retain certain information as required or permitted by applicable law. You may make these requests by contacting us using the contact information provided below in the “How to Contact Us” Section below. After submitting your request, please monitor your email for a verification email. We are required by law to verify your identity prior to granting access to your data in order to protect your privacy and security.
California residents are entitled to ask us for a notice identifying the categories of personal information which we share with our affiliates and/or third parties for marketing purposes and providing contact information for such affiliates and/or third parties. If you are a California Resident and would like to exercise your rights under CCPA, please submit a written request using the information provided in the “How to Contract Us” section below. Our privacy team will examine your request and respond to you as quickly as possible.
International Visitors Outside of EU/EEA
Our sites are hosted and operated in the United States. Outside of international visitors or End-users from the EU/EEA, by using our websites and Services, you are consenting to the transfer of your personal information to the United States. If you are accessing the Services from outside the United States or the EU/EEA, please be advised that the United States law may not offer the same privacy protections as the law in your jurisdiction.
Children’s Privacy
We recognize the need to provide further privacy protections with respect to personal information we may collect from children using our Solution. When we collect personal information from children, we take the following steps to protect children’s privacy:
Children under the age of 13 may not register or create accounts through our Services, or otherwise provide us with personal information. If you learn that a child has provided us with personal information in violation of this Privacy Policy, you may alert us at privacy@floreovr.com.
School Data Compliance
We understand the obligation educational agencies, districts and school systems have to comply with applicable privacy and data protection laws, such as the Family Educational Rights and Privacy Act (FERPA), the Children’s Online Privacy Protection Act (COPPA) in the U.S. and the Freedom of Information Privacy Protection Act (FIPPA) in Canada. Our Privacy Policy is structured to be compliant with FERPA, COPPA and FIPPA, and we support schools in their compliance efforts and facilitate their alignment with FERPA, COPPA and FIPPA.
Under the terms of our contracts with schools, we agree to act as a "School Official" as defined by FERPA, meaning that we:
Under the terms of our contracts with schools, we agree to the state specific data security and privacy requirements, as amended from time to time, and the following state laws are incorporated herein by reference, to the extent that any of the provisions apply to Floreo’s possession and use of Learner and school PII:
How to Contact Us
You can update your account and profile information through your profile settings. If you have questions about your privacy on our Services, this Privacy Policy, or information we have about you, or you believe that we are not complying with the principles set out in this Privacy Policy, please contact us at privacy@floreovr.com.
You may also file a complaint by contacting us at privacy@floreovr.com. Please provide as much detail as possible about your complaint so we can fully investigate and respond effectively. We take all feedback seriously and commit to address your concerns thoroughly and respectfully.
If you wish to report a security breach, please contact us at security@floreovr.com.
iKeepSafe Safe Harbor Program
We participate in the iKeepSafe Safe Harbor Program. If your complaint involves data privacy practices that have not been resolved satisfactorily, you may contact iKeepSafe through their consumer complaint process. Please visit https://ikeepsafe.org/contact for more information or email them directly at privacy@ikeepsafe.org.
Changes to this Privacy Policy
We will post any adjustments to the Privacy Policy on this page, and the revised version will be effective when it is posted. If we materially change the ways in which we use or share personal information previously collected from you through our Services, we will post changes on our website and notify you through our Services, by email, or other communication.
This policy has been updated as follows: