Terms of Service

1. Identification of the Parties

The Provider

The Client

A licensed psychology professional or legal entity that contracts access to the Software under the terms described herein.

VRET is marketed exclusively as a professional or business licence for clinics and healthcare professionals; it is not offered or sold to individual consumers or to patients. The Client contracts the Software within the scope of its professional or business activity and, accordingly, declares that it does not hold the status of a consumer or user within the meaning of Royal Legislative Decree 1/2007 (General Law for the Defence of Consumers and Users). The warranties and conditions set out in these T&Cs are contractual in nature between professionals (B2B) and do not constitute consumer rights.

2. Object of the Contract

These Terms and Conditions (hereinafter, “T&Cs”) govern the relationship between the Provider and the Client for access to and use of the VRET platform (hereinafter, “the Software”), a SaaS (Software as a Service) service that provides virtual reality environments for use in therapeutic sessions supervised by mental health professionals.

Acceptance of these T&Cs is a prior and indispensable requirement for access to the Software.

Master Services Agreement. The paid service is also governed by the VRET SaaS Master Services Agreement (version 1.9, dated 24 September 2026), its annexes and the Order Form, which the Client receives and accepts before the first payment. Where both texts deal with the same matter, the accepted Master Services Agreement prevails. These T&Cs summarise it and also govern the free account and anything the Master Services Agreement does not cover.

3. Description of the Service

3.1 What the service includes

• Access to the VRET platform according to the contracted plan.
• Catalogue of virtual reality scenarios for clinical use.
• Control panel for the professional (session management, metrics).
• Technical support by email Monday to Friday, 9:00–18:00 (Europe/Madrid time), excluding public holidays at the Provider’s address.
• Software updates included for the duration of the subscription.
• Remote onboarding and basic usage training of up to three hours per Client, which may be split into three sessions scheduled by agreement.

3.2 What the service does NOT include

• Hardware (virtual reality headsets, computers, peripherals), except for the headset supplied once, on first purchase, with Standard Pro (section 4.1).
• Clinical or psychological advice.
• Development of custom scenarios (available as an additional service upon quotation).
• Support outside business hours (except Enterprise plans with a specific SLA).
• Integration with third-party clinical record systems (future roadmap).

4. Plans and Prices

4.1 Available plans

Customers who subscribed to an intermediate plan before 1 September 2026 keep the pricing and the limits assigned to them, even though that plan no longer appears in the table above and can no longer be subscribed to.

The Standard plan can be paid monthly, annually or as a 12-, 24- or 36-month prepayment. Standard Pro is an annual, sales-assisted option purchased through a personalised offer: it supplies, once and on first purchase only, the headset identified in the offer; renewals do not include another headset. A headset licence is the right to one simultaneous connection, not ownership of a particular device, and can be reassigned to another compatible headset once the previous one has been unlinked.

4.2 Onboarding and setup

The initial setup, remote onboarding and basic usage training (up to three hours per Client) are included in the subscription of any plan, at no additional cost and with no sign-up fee. Optional professional services (clinical consultancy, custom scenarios, in-person training) are available as add-ons under a separate quotation.

4.3 Billing

• Billing is in advance, at the start of each contracted period: monthly, annual, or the 12-, 24- or 36-month prepaid term.
• Payment is made by direct debit or credit card.
• Invoices are issued in electronic format in accordance with Spanish tax regulations. Where required, they will be issued and received via B2B electronic invoicing in accordance with Law 18/2022, Royal Decree 238/2026 and its implementing regulations, without prejudice to the regulations on billing software systems (Royal Decree 1007/2023, VERI*FACTU) where applicable.
• All prices are quoted excluding VAT. As this is a B2B service, the applicable VAT depends on the buyer’s country: clients in Spain are charged 21%; companies in other EU countries with a valid VAT number (Spanish VAT ID) are subject to the reverse charge (no VAT is charged and the client self-assesses it). Stripe calculates and applies the corresponding tax on each invoice in accordance with the applicable legislation.

4.4 Non-payment

For overdue amounts that are legally payable:

• 7 calendar days after the due date, a reminder will be sent by email.
• From day 15 (a 15-day grace period), the Provider may suspend active use of the Software.
• From day 30, the Provider may terminate the contract.

Suspension and termination require prior notice of the amount owed and the consequences, and will be applied proportionately so as not to cause an unsafe clinical interruption. Suspension is not erasure: data are kept and export is not withheld as security for payment. If the contract is terminated, data follow the exit timetable in section 12.4.

As this is a commercial transaction between professionals, the late-payment interest and recovery costs permitted by law apply, including Spanish Law 3/2004 on combating late payment where applicable, without duplication.

5. Price Modification

The committed price does not increase during an initial or renewed term already accepted (monthly, annual or prepaid), except for legally applicable taxes or an expansion requested by the Client. For later periods, the Provider may propose a new price subject to the following conditions:

• Prior notice: Active communication by email at least 60 days before the new prices take effect.
• Effect: The new prices will apply from the next renewal period after the notice. Without valid notice, the renewal keeps the previous price.
• Right not to renew: A Client that does not accept the new prices may prevent renewal without any penalty by requesting non-renewal before the period at the new price begins (section 12.2).
• Commitment: Prices will not be modified more than once every 12 months, except due to changes in applicable taxation.

6. Satisfaction Guarantee

VRET offers a voluntary 30-calendar-day money-back guarantee on the first purchase of a subscription, the same for all plans. If the Client is not satisfied with the service, it may request a refund of the price within that period, with no minimum-use requirement and no penalty. The guarantee does not replace remedies for breach.

6.1 Guarantee — 30 days (all plans)

The 30-calendar-day period starts at the usable activation notified by VRET to the Client. For Standard Pro, where the included headset is needed to use the service, it cannot start before the Client receives the headset in conforming condition. The guarantee applies solely to the first purchase and does not restart on renewal, expansion or plan change.

6.2 Conditions applicable to the guarantee

• The request is made from the control panel, which issues a receipt, or by email to contacto [arroba] vret.es, before the period ends.
• VRET will refund the amounts due within a maximum of 14 calendar days, using the same payment method as the original transaction unless another lawful method is agreed.
• For Standard Pro, the Client has a further 14 days from its request to send back the headset and its accessories with tracking; the carriage cost of this voluntary return is borne by the Client. Until the headset or sufficient proof of dispatch is received, VRET may only provisionally withhold the headset value disclosed before purchase.

6.3 What the guarantee does not cover

• Renewals, expansions and plan changes after the first purchase.
• Separately purchased goods (for example, a kit) and bespoke work, unless an offer expressly includes them; their own conformity rights remain unaffected.
• For Standard Pro, the returned headset must include its accessories and must not have been destroyed, had content extracted or been misused; the lack of the original box does not, on its own, prevent a return.

6bis. Acceptable Use Policy (AUP)

The Client undertakes to use the Software in accordance with these T&Cs, applicable professional ethics, and current legislation. In particular, the Client may not:

• Use the Software for purposes other than supervised therapeutic intervention in accordance with the Medical Disclaimer.
• Allow access to its account by unauthorised third parties or share credentials.
• Carry out reverse engineering, decompilation, decryption, or any attempt to extract source code, cryptographic keys, or the content of the VR scenarios.
• Reproduce, distribute, sublicense, sell, rent, or transfer to third parties the VR scenarios, templates, protocols delivered by VRET, or any derivative material.
• Use the Software or session data to train its own or third parties’ AI models (a clause reciprocal to the one assumed by VRET in the opposite direction).
• Perform load testing, vulnerability scans, or penetration testing on the platform without prior written authorisation (a responsible disclosure program is available at seguridad [arroba] vret.es).
• Circumvent the technical limits of the contracted plan (number of therapists, number of headsets, etc.).
• Use the Software for unlawful purposes, contrary to public order, or that infringe the rights of third parties.

Breach of the AUP entitles the Provider to block the affected scope or terminate the contract, proportionately and in accordance with section 12.3.

7. Client Requirements

7.1 Professional requirements

The Client represents and warrants that:

• Its users hold the qualification, registration and competence required for their actual title, activity and place of practice (for example, HCPC registration for protected practitioner-psychologist titles in the United Kingdom, or membership of an Official College of Psychologists in Spain where the law requires it), in line with clause 4.1 of the master agreement.
• It holds the necessary professional qualification to use therapeutic exposure tools in its clinical practice.
• It uses the Software exclusively in the context of supervised therapeutic sessions.

7.2 Technical requirements

• A compatible virtual reality device (compatibility list available on the Website).
• A stable Internet connection (minimum recommended: 20 Mbps).
• An up-to-date web browser for access to the control panel.

7.3 Client obligations

• Maintain the confidentiality of its access credentials.
• Not share its account with unauthorised third parties.
• Not use the Software for purposes other than those described in these T&Cs.
• Not carry out reverse engineering, decompilation, or extraction of the source code.
• Not reproduce or distribute the virtual reality scenarios.
• Comply with data protection regulations with respect to its patients.

8. Limitation of Clinical Liability

8.1 General principle

The Software is a professional support tool. The Provider does not carry out healthcare activity and does not take the Client’s clinical decisions. It remains liable for its own breaches, attributable defects, instructions, security and data processing.

8.2 Liability of the professional

The Client is responsible for:

• The clinical assessment of the patient’s suitability for virtual reality sessions.
• The selection of appropriate scenarios for each case.
• The supervision and control of each session.
• Obtaining the patient’s informed consent.
• Compliance with the healthcare and ethical regulations applicable to its professional practice.

8.3 Exclusions of liability

The Provider shall not be liable for:

• Damages arising from improper or negligent use of the Software by the Client.
• Adverse reactions of the patient resulting from the Client’s clinical decisions (indication, selection, intensity or supervision of the session), unless they are attributable to a defect, instruction or breach of the Provider.
• Indirect loss, loss of profit, loss of opportunity, business, clientele or reputation, save in the cases listed in section 8.4. Direct loss is not excluded, nor are reasonable data-recovery and mitigation costs where attributable to the Provider; they are subject to the limits in section 8.4.

8.4 Quantitative limitation

• General limit: for each contractual year, each party’s aggregate liability is limited to the Annual Base: twelve times the contractual monthly fee or, for prepayments, the plan and recurring add-on price for the period divided by its number of months and multiplied by twelve. The committed price is used, not payments made in the preceding twelve months. For Standard Pro the full package price is included, and the price of a directly affected, separately purchased good is added where the claim also concerns it.
• Higher limit: for breaches of confidentiality or data protection and for the indemnities in section 12bis, the limit is twice the Annual Base. This is an overall higher limit, not an amount added to the general one.
• No limit: nothing limits or excludes liability for fraud, fraudulent misrepresentation, wilful misconduct or gross negligence, attributable death, personal injury or damage to health, mandatory product liability, data subjects’ rights, regulators’ powers or any liability that cannot lawfully be excluded or restricted. Payment obligations, refunds of unearned prepayments and restitution under the Master Services Agreement are not limited either.

9. Intellectual and Industrial Property

9.1 Ownership

All intellectual and industrial property rights over the Software, including but not limited to: the source code and architecture of the Software, the virtual reality scenarios (3D models, audio, design), the VRET brand, logos, and visual identity elements, and the technical and commercial documentation, are the exclusive property of the Provider and are protected by the intellectual and industrial property legislation in force in Spain and the European Union.

9.2 Licence of use

The subscription grants the Client a non-exclusive, non-transferable licence to use the Software in accordance with these T&Cs, for the paid term. It may only be suspended or ended for the reasons and under the procedures in sections 4.4 and 12; it cannot be revoked at the Provider’s discretion during a contracted period.

9.3 Content generated by the Client

The session data, notes, and configurations created by the Client within the Software are the property of the Client. The Provider claims no ownership over such content.

9.4 Custom VR scenarios (Enterprise)

When, under a written Statement of Work (SOW), the Provider develops a custom VR scenario for the Client, ownership of the intellectual property follows the rules below unless otherwise agreed in the SOW:

• Code, scripts, 3D models, audio, and new assets created by the Provider: owned by the Provider. The Client receives a perpetual, non-exclusive, worldwide, and non-transferable licence for internal use with its patients.
• Materials contributed by the Client (logo, photographs, voice-overs, clinical protocols): owned by the Client; the Client grants the Provider a licence limited to the purpose of the SOW.
• Sector exclusivity: the Client may contract, under a separate SOW, an option for temporary exclusivity by clinical vertical.

9.5 No AI training

The Provider will not use the Client’s clinical data or the patient data processed on its behalf to train its own or third parties’ artificial intelligence models. This obligation is binding and is reproduced in the DPA.

10. Service Availability

10.1 Availability objective

The Provider pursues a monthly availability objective of 99.5% for the hosted service, excluding reasonable scheduled maintenance. This is a diligence and monitoring objective, not a guaranteed-result SLA, and it does not give rise to automatic service credits. The calculation and relevant incidents are documented. A different SLA must be expressly agreed.

10.2 Scheduled maintenance

• It will preferably be carried out between 22:00 and 06:00, Europe/Madrid time.
• It will be communicated by email at least 48 hours in advance. Urgent security work may take place sooner, with notice as soon as possible.
• Unexpected downtime will not be labelled scheduled maintenance.

10.3 Interruptions

• Force majeure excuses non-performance only to the extent it causes it, and must be notified and mitigated.
• The Client’s connectivity and equipment are outside the Provider’s control to the extent they cause the interruption.
• Failures of providers engaged by the Provider do not create an automatic exemption.

11. Data Protection

The processing of personal data is governed by VRET’s Privacy Policy, available at https://vret.app/privacy, and by the technical and organisational measures described at https://vret.app/security.

Dual role of the Provider. For the Client’s data (data of the contracting professional), the Provider acts as Data Controller. For the patient data processed on behalf of the Client within the platform, the Provider acts as Data Processor (Art. 28 GDPR).

DPA. Acceptance of these T&Cs incorporates the Data Processing Agreement published at https://vret.app/legal/dpa as a binding contractual Annex. The DPA governs:

• Subject matter, nature, duration, and purpose of the processing on behalf of the Client.
• Categories of patient data processed (clinical notes, SUDS markers, telemetry, home practice and biofeedback signals).
• The Provider’s obligation to process the data exclusively under documented instructions from the Client.
• Confidentiality commitment of the personnel with authorised access.
• Security measures under Art. 32 GDPR applied by the Provider.
• Assistance to the Client in responding to the patient’s ARCO+ rights and in complying with the obligations of Arts. 32 to 36 GDPR.
• Canonical list of sub-processors (record II.B of the DPA, synchronised with /security), with 30 days' active notice and a reasoned right to object for any addition or replacement (II.7).
• An auditable break-glass procedure for support access.
• Notification to the Client of breaches without undue delay from detection (target 24 h).
• Return or deletion of data at the end of the service under the timetable in section 12.4 (export until D+30, removal from production systems no later than D+60 and expiry of backups by D+97 at the latest), save for retention required by law or additional custody agreed before expiry.
• A no-AI-training clause for clinical data.
• A continuity clause: 90 days’ prior notice and a full export in the event of cessation of the Provider’s activity.

If the Client requires reasonable modifications to the standard DPA (additional clauses, DPO-specific annexes), we will negotiate them before signing. The accepted version is versioned and archived.

12. Duration and Cancellation

12.1 Term and renewal

Each subscription has the term stated in its Order Form: monthly, annual, or a 12-, 24- or 36-month prepayment. On expiry it renews automatically for a period of the same length, unless the Client requests non-renewal before expiry (section 12.2). For 12-, 24- and 36-month prepayments, the Provider will notify the Client by email, at least 60 days in advance, of the expiry date, the renewal amount and the charge date.

12.2 Non-renewal and cancellation by the Client

• The Client may request non-renewal at any time before the next period, from the control panel or by email, and will receive a receipt. No additional notice period is required.
• Cancellation of a monthly or annual subscription takes effect at the end of the current period, except for the guarantee in section 6, a breach by the Provider or a special right.
• For 12-, 24- and 36-month Standard prepayments, voluntary early termination refunds the amount paid less the months of service used at the monthly list price applicable at purchase, and creates no further debt if the result is zero.
• Otherwise, periods already invoiced are not refunded. Where the contract ends because of the Provider’s breach, the unearned part of any prepayment is refunded.

12.3 Termination by the Provider

• For a material breach by the Client not remedied within 15 days of notice.
• Immediately and with reasons, limited to the affected scope, for an irremediable breach, illegality or serious risk: for example, use of the Software for illegal purposes or purposes contrary to professional ethics, or a materially false declaration of professional qualification.
• For non-payment, from day 30 under section 4.4.

The Provider cannot end a paid term for convenience. If it plans to cease trading, it will give 90 days’ notice.

12.4 Effects of termination and exit timetable

When the service ends (effective date “D”), active use stops, but export, restricted processing and erasure under the DPA continue:

• Until D+30, a limited export and return channel remains available (structured CSV/JSON formats and the Client’s files), with no new sessions.
• Afterwards, data are restricted to exit, security or erasure, and removed from production systems no later than D+60, or earlier where a valid instruction or statutory deadline requires it.
• Ordinary backups expire by D+97 at the latest, and erased data are never reintroduced from them.
• Suspension for non-payment is neither termination nor erasure.

12bis. Cross-Indemnity

Each party shall hold the other harmless against third-party claims arising from:

• By the Provider: infringement of third-party intellectual property rights by the delivered Software, or a data protection breach attributable to it as Processor.
• By the Client: use of the Software outside the boundary described in the Medical Disclaimer, breach of the AUP (section 6bis), lack of the patient’s informed consent, use for unlawful purposes, or claims arising from its clinical practice, solely to the extent attributable to it.

Neither party is liable for the part of a claim caused by the other. The indemnity is subject to the higher limit and the exceptions in section 8.4.

13. Communications

All communications between the parties will be carried out by electronic means:

• From the Provider to the Client: The email registered in the Client’s account.
• From the Client to the Provider: contacto [arroba] vret.es.

Each party will keep its contact details up to date. The Provider will keep evidence of sending, content and delivery; if an email bounces, it will make a reasonable attempt through another channel. Notices of price changes, material amendments, breach or assignment are communicated actively, not merely published on the Website.

14. Dispute Resolution

14.1 Amicable negotiation

The parties undertake to attempt to resolve any dispute arising from these T&Cs through good-faith negotiation for 30 calendar days, and to meet any legally applicable pre-action requirements. This does not prevent urgent measures, steps needed to preserve time limits or complaints to authorities.

14.2 Jurisdiction

If no agreement is reached, disputes will be heard by the courts competent under the applicable rules. No compulsory territorial forum is imposed through these standard terms; a different jurisdiction agreement requires a separate, genuinely negotiated agreement.

14.3 Applicable law

These T&Cs are governed by Spanish law, without excluding applicable mandatory rules or the independent rights of data subjects or third parties.

15. General Provisions

These T&Cs, together with the Master Services Agreement and the Order Form accepted for the paid service (which prevail as set out in section 2), the Privacy Policy, the DPA, the Medical Disclaimer, the Cookie Policy, and the LSSI-CE Legal Notice, constitute the entire agreement between the parties in relation to the use of the Software.

If any clause is declared void or unenforceable, the remaining clauses will retain full force and effect. The Provider’s failure to exercise any right shall not constitute a waiver thereof.

15.1 Assignment of the contract

Neither party may voluntarily assign its contractual position without identifying the successor and obtaining the other party’s written acceptance. The planned transfer to a Spanish limited company will be proposed with at least 30 days’ prior information through a short deed that the Client may accept electronically; the company will honour committed prices, prepayments, guarantees, licences and the DPA. Silence or continued use is not acceptance. If the Provider cannot offer continuity, the Client may leave without penalty and recover the unearned part of any prepayment. Transfers by operation of law follow the applicable rules.

15.2 Modification of the T&Cs

Security fixes and minor changes that do not materially reduce the service may be applied with reasonable information. Material amendments will be communicated by email at least 30 days in advance and, for the paid service, require express acceptance under the Master Services Agreement. They do not retroactively alter accepted orders or acquired guarantees.

15.3 Versioning

We maintain a version history of these T&Cs. The version applicable to each Client is the one accepted at the time of its sign-up or the latest version communicated and accepted in accordance with section 15.2.

15.4 Language

The master text is drafted in Spanish and the English and Portuguese versions are kept aligned with it. The version of the Master Services Agreement supplied and selected in the Order Form has contractual effect, not merely informational effect. A version that was not supplied will not be invoked to reduce rights communicated to the Client, and differences are interpreted under the applicable law and what was actually agreed, with no unilateral right for the Provider to resolve them in its favour.

16. LSSI-CE Compliance

In compliance with Law 34/2002, of 11 July, on Information Society Services and Electronic Commerce (LSSI-CE):

• The Provider identifies itself in accordance with Article 10 of the LSSI-CE (details in section 1).
• Commercial communications comply with Article 21 of the LSSI-CE: they are only sent with the prior consent of the recipient.
• In existing contractual relationships, communications about similar products or services may be sent, always offering the possibility to object.
• All commercial communications are clearly identified as such.