Vicky — Privacy Policy

Last updated: 28 October 2026

1. Who Is Responsible for Your Data? (Controller vs. Processor)

Vicky is an enterprise / institutional education platform (B2B). How GDPR roles are assigned matters for contracts and university legal reviews.

1.1 Your university or college is typically the Data Controller

For personal data relating to students, faculty, and staff who access the platform under an institutional subscription, the educational institution that contracted for Vicky (the Data Controller) decides why and how that data is used for its educational and administrative purposes. The institution determines enrollment, cohorts, courses, assignments, and which authorized staff may view progress and analytics.

1.2 Pi tech is the Data Processor

Π ΙΔΙΩΤΙΚΗ ΚΕΦΑΛΑΙΟΥΧΙΚΗ ΕΤΑΙΡΕΙΑ (English trade name: Pi Private Company), VAT EL801289442, Greece — referred to in this policy as "Pi tech," "we," "us," or "our" — acts as Data Processor under Article 28 GDPR. We provide the Vicky software, hosting stack, and subprocessors only to process personal data on behalf of the institution and in accordance with our agreement with that institution (including the applicable Data Processing Agreement).

We do not use institutional user data to make independent decisions about students’ academic standing; grading and academic decisions remain with the institution.

Registered office / correspondence: K. Karamanli 67, 546 42 Thessaloniki, Greece

GEMI (General Commercial Registry) number: 153620048000

Processor / privacy contact (technical and contractual inquiries):
Email: [email protected]
Phone: +30 23120 02793

Institutional Data Protection Officers and legal teams may also request our sub-processor list, standard contractual clauses, and DPA documentation via this address.

2. About This Policy

This Privacy Policy explains how Pi tech, as processor, processes personal data when you use the Vicky platform on behalf of your institution (the controller).

The Vicky platform (the "Service") consists of:

• The Vicky web portal (for instructors and administrators) — currently offered in production
• The Vicky VR application (Meta Quest) — currently offered in production
• The Vicky mobile application — available on Android through Google Play to students whose institution has invited them. The iOS application is not yet available on the App Store.

Ελληνικά: Η εφαρμογή Vicky για κινητά είναι διαθέσιμη για Android μέσω του Google Play σε φοιτητές που έχουν προσκληθεί από το ίδρυμά τους. Η εφαρμογή για iOS δεν είναι ακόμη διαθέσιμη στο App Store.

This single privacy policy covers these surfaces because they share the same accounts, tenant-scoped data infrastructure, and processing arrangements with subscribing institutions.

This policy is provided in accordance with the EU General Data Protection Regulation (GDPR — Regulation 2016/679), the Greek Data Protection Law (Law 4624/2019), and other applicable data protection law. Determination of the lawful basis for processing personal data about students and staff is primarily the responsibility of your institution as controller; this document describes our processing obligations as processor and transparency for end users.

3. Information We Process (on Behalf of Your Institution)

The following describes categories of personal data processed through the Service under the subscribing institution’s instructions and configuration. Your institution remains responsible for the lawfulness of the processing it instructs us to perform.

3.1 Account Information

When your institution registers you or you create an account within a tenant, we process:

• Email address — used for authentication and communication
• Full name — used for personalization and display within the platform
• Institutional affiliation — university, department
• Role — student, professor, or administrator
• Profile picture (optional) — a picture you choose from your device’s photo library, or one of the preset pictures; used as your avatar in the platform

3.2 Usage and Training Data

When you use the Service to complete labs, assessments, and training exercises, we process:

• Lab attempt data: start and end times, duration, completion status, number of hints used, resets, and critical errors encountered
• Step-by-step interaction events: which steps were completed, timestamps, and interaction types within a lab scenario
• Assessment responses: answers submitted during quizzes and assessments, scores, and completion times
• Assignment status: due dates, submission status, and progress tracking
• Application and portal activity: sign-ins, screens or pages viewed, and features opened, including Vicky and labs. These events are linked to your account and institution. Access is limited to you for your own records and Pi tech platform staff for operating and supporting the Service. Retention is described in §10.

Ελληνικά — Δραστηριότητα στην εφαρμογή και στη διαδικτυακή πύλη: συνδέσεις, οθόνες ή σελίδες που προβλήθηκαν και λειτουργίες που ανοίχτηκαν, όπως η Vicky και τα εργαστήρια. Αυτά τα συμβάντα συνδέονται με τον λογαριασμό σου και το ίδρυμά σου. Πρόσβαση έχεις εσύ για τις δικές σου εγγραφές και το προσωπικό διαχείρισης της πλατφόρμας της Pi tech για τη λειτουργία και την υποστήριξη της Υπηρεσίας. Η διατήρησή τους περιγράφεται στην §10.

3.3 AI Interaction Data

When you interact with VICKY, our AI teaching assistant, we process:

• Chat messages you send to VICKY (text queries about lab content)
• Lesson engagement data: which slides you viewed, narration playback events, and quiz responses within AI-generated lessons
• AI-generated content metadata: lesson identifiers, generation timestamps, and content versions
• During a live assessment, Vicky records that a question about it was asked (no message text).

Vicky conversations. The platform and Vicky support education and training, not medical advice or care. Do not enter identifiable patient information or personal health information about yourself or anyone else. Use hypothetical cases for learning.

Your questions and Vicky's replies are stored with your account so you can return to a conversation. Deleting a conversation removes its messages from your conversation history; deleting a conversation must not be understood as deleting every learning profile or every provider record. The current platform notice sets no platform-wide maximum age for chat history. Your institution may agree a retention period with us. To request erasure of your conversations and associated personal data, contact your institution's data protection office; you can also write to [email protected] so we can assist your institution. Separate processor retention periods and any lawful exceptions are described in this notice.

Συνομιλίες με τη Vicky. Η πλατφόρμα και η Vicky υποστηρίζουν την εκπαίδευση και την εξάσκηση, όχι την παροχή ιατρικών συμβουλών ή φροντίδας. Μην εισάγεις πληροφορίες που ταυτοποιούν πραγματικό ασθενή ή προσωπικές πληροφορίες υγείας για εσένα ή άλλον άνθρωπο. Για τη μάθηση χρησιμοποίησε υποθετικά περιστατικά.

Οι ερωτήσεις σου και οι απαντήσεις της Vicky αποθηκεύονται στον λογαριασμό σου, ώστε να μπορείς να επιστρέφεις σε μια συνομιλία. Η διαγραφή μιας συνομιλίας αφαιρεί τα μηνύματά της από το ιστορικό σου· δεν σημαίνει ότι διαγράφεται κάθε προφίλ μάθησης ή κάθε αρχείο παρόχου. Η ισχύουσα ενημέρωση της πλατφόρμας δεν ορίζει ενιαίο ανώτατο χρόνο διατήρησης του ιστορικού συνομιλιών. Ο οργανισμός σου μπορεί να συμφωνήσει μαζί μας συγκεκριμένο χρόνο διατήρησης. Για να ζητήσεις διαγραφή των συνομιλιών σου και των σχετικών προσωπικών δεδομένων, επικοινώνησε με το γραφείο προστασίας δεδομένων του οργανισμού σου· μπορείς επίσης να γράψεις στο [email protected], ώστε να βοηθήσουμε τον οργανισμό σου. Οι ξεχωριστοί χρόνοι διατήρησης από παρόχους και τυχόν νόμιμες εξαιρέσεις περιγράφονται σε αυτή την πολιτική.

We do not use your chat messages or training data to train any AI model, and our providers are contractually barred from doing so. Our primary AI provider (Microsoft, Azure OpenAI Service) keeps prompts and responses for up to 30 days for abuse monitoring, inside the EU Data Boundary; a person at Microsoft reviews them only if its automated systems flag possible misuse. We cache prompts for up to 24 hours to improve response times. Neither is used to train a model.

3.4 Device and Technical Information

The Service automatically processes:

• Device type: mobile (Android/iOS), VR headset (Meta Quest), or web browser (when using the portal)
• Operating system and version
• Application version
• Network connectivity status (online/offline, for telemetry synchronization)
• Crash and error reports: diagnostic details used to investigate failures and maintain reliability. Reports sent by the signed-in mobile app are linked to your account as activity records; they are not anonymous. Retention is described in §10.

Ελληνικά — Αναφορές κατάρρευσης και σφαλμάτων: διαγνωστικά στοιχεία που χρησιμοποιούνται για τη διερεύνηση αστοχιών και τη διατήρηση της αξιοπιστίας. Οι αναφορές που αποστέλλει η εφαρμογή κινητού όταν έχεις συνδεθεί συνδέονται με τον λογαριασμό σου ως εγγραφές δραστηριότητας· δεν είναι ανώνυμες. Η διατήρησή τους περιγράφεται στην §10.

We do not collect device advertising identifiers (IDFA/GAID).

3.5 Camera Data

The Vicky mobile application accesses your device camera for the augmented reality (AR) lab experiences and, in a field session, for the live stream to your instructor. In an AR lab, camera frames are processed locally on your device by the AR engine for real-time scene rendering and are never recorded, stored, transmitted to our servers, or shared with third parties. In a field session (an optional feature your institution grants, §3.7), the camera and the microphone stream your point of view and voice to your institution's instructors through Pi tech's media server, and are stored only when you have agreed to a recording.

Ελληνικά: Η εφαρμογή Vicky για κινητά αποκτά πρόσβαση στην κάμερα της συσκευής σου για τα εργαστήρια επαυξημένης πραγματικότητας (AR) και, σε μια συνεδρία πεδίου, για τη ζωντανή μετάδοση στον εκπαιδευτή σου. Σε ένα εργαστήριο AR, τα καρέ της κάμερας υποβάλλονται σε επεξεργασία τοπικά στη συσκευή σου από τη μηχανή AR για την απόδοση της σκηνής σε πραγματικό χρόνο και δεν καταγράφονται, δεν αποθηκεύονται, δεν μεταδίδονται στους διακομιστές μας ούτε κοινοποιούνται σε τρίτους. Σε μια συνεδρία πεδίου (προαιρετική λειτουργία στην οποία το ίδρυμά σου παραχωρεί πρόσβαση, §3.7), η κάμερα και το μικρόφωνο μεταδίδουν την εικόνα από τη δική σου οπτική και τη φωνή σου στους εκπαιδευτές του ιδρύματός σου μέσω του διακομιστή πολυμέσων της Pi tech. Η εικόνα και η φωνή αποθηκεύονται μόνο εφόσον έχεις συναινέσει σε καταγραφή.

Camera access requires your explicit device-level permission, which you can revoke at any time through your device settings.

Ελληνικά: Η πρόσβαση στην κάμερα απαιτεί τη ρητή άδειά σου στη συσκευή, την οποία μπορείς να ανακαλέσεις οποιαδήποτε στιγμή από τις ρυθμίσεις της συσκευής σου.

3.6 Feedback and Support Data

If you voluntarily submit feedback or bug reports through the app, we process:

• The text of your feedback
• An optional screenshot (only if you choose to attach one from your photo library)
• Device and app version information for debugging purposes

3.7 Field sessions (live supervised practice)

English

Field sessions are an optional feature for emergency-response training that your institution enables and grants to specific users (responders and instructors). Nothing in this section applies to you unless you hold that capability and start a field session yourself.

When you start a field session, the Service processes, on your institution's behalf:

• Live video and voice from your phone's camera and microphone, or from Meta Ray-Ban glasses paired to your phone, streamed in real time to your institution's instructors through a media server operated by Pi tech on Microsoft Azure in the EU. The live stream is encrypted in transit and is not stored unless a recording is made as described below.
• Your position (GPS coordinates, accuracy, speed and heading), only while the "Share my location with my instructor" switch is on, including while your phone is locked or in a pocket during the exercise. Your phone shows the system's location indicator the whole time. You can turn the switch off at any time; sharing stops at once.
• A recording of the stream (video and your voice; the instructor's voice is not recorded), only if you turned on "My instructor may record this session" on the start screen and an instructor started the recording. Recordings are stored in the EU (Frankfurt, Germany) and are visible only to your institution's instructors. You can withdraw recording consent at any time in the app; withdrawal prevents new recordings and does not delete a recording your institution already holds, which follows the retention below.
• The session timeline and connection quality: when the session started and ended, which camera was used, the phone's network type, whether the phone was locked, the instructor's cues and notes, and technical measurements of the stream (bitrate, frame rate, packet loss, round-trip time). These form the training record of the exercise and are visible to your institution's instructors.

The live stream and training record are available only to your institution's instructors, never to other students. Position data is used for the instructor's live map and the institution's training record only. It is never used for advertising, profiling or tracking and is never sold or shared outside your institution.

Recordings are kept for 90 days, then automatically deleted. Positions are kept for 90 days, then automatically deleted; your institution may set a shorter period of 1–90 days. The session timeline and connection-quality samples are kept with the session record (see "Session metadata" in §10).

Συνεδρίες πεδίου (ζωντανή εποπτευόμενη πρακτική)

Ελληνικά

Οι συνεδρίες πεδίου είναι μια προαιρετική λειτουργία εκπαίδευσης στην αντιμετώπιση επειγόντων περιστατικών, την οποία το ίδρυμά σου ενεργοποιεί και παραχωρεί σε συγκεκριμένους χρήστες (ανταποκριτές και εκπαιδευτές). Η παρούσα ενότητα δεν σε αφορά, εκτός αν έχεις πρόσβαση στη λειτουργία και ξεκινήσεις εσύ μια συνεδρία πεδίου.

Όταν ξεκινάς μια συνεδρία πεδίου, η Υπηρεσία επεξεργάζεται για λογαριασμό του ιδρύματός σου:

• Ζωντανή εικόνα και φωνή από την κάμερα και το μικρόφωνο του κινητού σου ή από γυαλιά Meta Ray-Ban συνδεδεμένα με το κινητό σου. Μεταδίδονται σε πραγματικό χρόνο στους εκπαιδευτές του ιδρύματός σου μέσω διακομιστή πολυμέσων που λειτουργεί η Pi tech στο Microsoft Azure εντός της ΕΕ. Η ζωντανή μετάδοση είναι κρυπτογραφημένη κατά τη μεταφορά και δεν αποθηκεύεται, εκτός αν γίνει καταγραφή όπως περιγράφεται παρακάτω.
• Τη θέση σου (συντεταγμένες GPS, ακρίβεια, ταχύτητα και κατεύθυνση), μόνο όσο είναι ενεργός ο διακόπτης «Share my location with my instructor» (Κοινοποίηση της τοποθεσίας μου στον εκπαιδευτή μου), ακόμη και όταν το κινητό σου είναι κλειδωμένο ή βρίσκεται στην τσέπη σου κατά την άσκηση. Το κινητό εμφανίζει συνεχώς την ένδειξη τοποθεσίας του συστήματος. Μπορείς να απενεργοποιήσεις τον διακόπτη οποιαδήποτε στιγμή· η κοινοποίηση σταματά αμέσως.
• Καταγραφή της μετάδοσης (εικόνα και τη δική σου φωνή· η φωνή του εκπαιδευτή δεν καταγράφεται), μόνο εφόσον έχεις ενεργοποιήσει το «My instructor may record this session» (Ο εκπαιδευτής μου μπορεί να καταγράψει αυτή τη συνεδρία) στην αρχική οθόνη και ένας εκπαιδευτής ξεκινήσει την καταγραφή. Οι καταγραφές αποθηκεύονται στην ΕΕ (Φρανκφούρτη, Γερμανία) και είναι ορατές μόνο στους εκπαιδευτές του ιδρύματός σου. Μπορείς να ανακαλέσεις τη συγκατάθεσή σου για καταγραφή οποιαδήποτε στιγμή μέσα από την εφαρμογή. Η ανάκληση εμποδίζει νέες καταγραφές και δεν διαγράφει καταγραφή που ήδη διατηρεί το ίδρυμά σου, για την οποία ισχύει ο χρόνος διατήρησης που αναφέρεται παρακάτω.
• Το χρονολόγιο της συνεδρίας και την ποιότητα σύνδεσης: πότε ξεκίνησε και έληξε η συνεδρία, ποια κάμερα χρησιμοποιήθηκε, τον τύπο δικτύου του κινητού, αν το κινητό ήταν κλειδωμένο, τις υποδείξεις και σημειώσεις του εκπαιδευτή και τεχνικές μετρήσεις της μετάδοσης (ρυθμός μετάδοσης δεδομένων, ρυθμός καρέ, απώλεια πακέτων και χρόνος μετάβασης και επιστροφής). Αυτά αποτελούν το εκπαιδευτικό αρχείο της άσκησης και είναι ορατά στους εκπαιδευτές του ιδρύματός σου.

Η ζωντανή μετάδοση και το εκπαιδευτικό αρχείο είναι διαθέσιμα μόνο στους εκπαιδευτές του ιδρύματός σου, ποτέ σε άλλους φοιτητές. Τα δεδομένα θέσης χρησιμοποιούνται μόνο για τον ζωντανό χάρτη του εκπαιδευτή και το εκπαιδευτικό αρχείο του ιδρύματος. Δεν χρησιμοποιούνται ποτέ για διαφήμιση, δημιουργία προφίλ ή παρακολούθηση και δεν πωλούνται ούτε κοινοποιούνται εκτός του ιδρύματός σου.

Οι καταγραφές διατηρούνται για 90 ημέρες και στη συνέχεια διαγράφονται αυτόματα. Οι θέσεις διατηρούνται για 90 ημέρες και στη συνέχεια διαγράφονται αυτόματα· το ίδρυμά σου μπορεί να ορίσει μικρότερο διάστημα 1–90 ημερών. Το χρονολόγιο της συνεδρίας και τα δείγματα ποιότητας σύνδεσης διατηρούνται μαζί με το αρχείο της συνεδρίας (βλ. «Session metadata» στην §10).

4. Legal Basis for Processing

Article 6 GDPR — role of the controller: For personal data of students and staff, the subscribing institution (Data Controller) determines the applicable lawful basis (e.g. performance of a contract with the data subject, legitimate interests of the institution, legal obligation, or consent where required). Pi tech does not substitute for the institution’s assessment; our Data Processing Agreement records that we process only on documented instructions from the controller, except where EU or Member State law requires us to process data independently (e.g. court order).

Article 28 GDPR — processor obligations: Pi tech processes personal data necessary to deliver the subscribed Vicky functionality: authentication, lab delivery, assessments, telemetry, analytics visible to authorized institutional users, AI features configured by the institution, security, and support.

The table below describes typical purposes and common lawful bases that institutions rely on when using education platforms of this kind. It is informational for transparency and DPO review; your institution’s privacy notices and contracts govern the definitive legal basis for your data.

Objections and consent: To object to processing or to withdraw consent for processing where the institution relies on consent, contact your institution’s data protection contact in the first instance. You may also contact [email protected] so we can route the request to the appropriate controller or assist under Art. 28(3)(e).

5. Special Categories of Data

English

The Service is intended for education and training, with training records about learning and engagement. It is not intended to collect identifiable patient information or personal health information about you or another person. Do not enter that information; use hypothetical cases for learning.

If you nevertheless include personal health information in a message to Vicky, the conversation contains health data, which can be special-category personal data under Article 9 of the GDPR. That information is processed with the conversation and stored in its history under the retention and deletion rules in §§3.3 and 10. This is different from its use in learning profiles, cross-conversation memory or teaching analytics; any applicable limits on those uses are described in §§3.3, 9 and 10. For an erasure request, follow §8. The institution's role and Pi tech's processor obligations remain as described in §§1 and 4.

Ελληνικά

Η Υπηρεσία προορίζεται για εκπαίδευση και εξάσκηση, με εκπαιδευτικά αρχεία που αφορούν τη μάθηση και τη συμμετοχή. Δεν προορίζεται για τη συλλογή πληροφοριών που ταυτοποιούν πραγματικό ασθενή ή προσωπικών πληροφοριών υγείας για εσένα ή άλλον άνθρωπο. Μην εισάγεις τέτοιες πληροφορίες· χρησιμοποίησε υποθετικά περιστατικά για τη μάθηση.

Αν παρ’ όλα αυτά συμπεριλάβεις προσωπικές πληροφορίες υγείας σε μήνυμα προς τη Vicky, η συνομιλία περιέχει δεδομένα υγείας, τα οποία μπορεί να αποτελούν ειδική κατηγορία προσωπικών δεδομένων κατά το άρθρο 9 του ΓΚΠΔ. Αυτές οι πληροφορίες υποβάλλονται σε επεξεργασία μαζί με τη συνομιλία και αποθηκεύονται στο ιστορικό της, σύμφωνα με τους κανόνες διατήρησης και διαγραφής στις §§3.3 και 10. Αυτό διαφέρει από τη χρήση τους σε προφίλ μάθησης, μνήμη μεταξύ συνομιλιών ή αναλύσεις για εκπαιδευτές· οι περιορισμοί που ισχύουν για αυτές τις χρήσεις περιγράφονται στις §§3.3, 9 και 10. Για αίτημα διαγραφής ακολούθησε την §8. Ο ρόλος του ιδρύματος και οι υποχρεώσεις της Pi tech ως εκτελούντος την επεξεργασία παραμένουν όπως περιγράφονται στις §§1 και 4.

The AR camera data is processed locally on your device and never reaches our servers.

6. How We Use Your Information

On behalf of the Data Controller (your institution), we process personal data for the following purposes, within the scope of our subscription and DPA:

• Provide the Service: authenticate your account, deliver lab and assessment content, track assignment progress, and personalize your learning experience as configured by the institution
• Generate analytics and progress reports: make aggregated and individual training metrics available to authorized professors and administrators of your institution through the platform
• Improve the platform: analyze usage patterns in aggregate to improve reliability and UX of the software (not for unrelated marketing)
• Deliver AI-powered features: provide VICKY features as subscribed and configured (e.g. narration, chat, lessons)
• Ensure platform security and integrity: detect and prevent misuse, enforce tenant isolation and role-based access, maintain security
• Communicate operational updates: service-related notifications tied to assignments and platform operation, in the app and by email: when a lab is made available to you as staff, when you are added to a course, and announcements from your institution. Every such email links to Profile → Updates, where you can switch each type off; your institution can also switch a type off for all its members. These emails never contain scores, grades or the text of an announcement (only its title). We do not send promotional email to institutional users without separate opt-in consent
• Respond to support requests: address feedback and bug reports you submit through the channels provided

We do not sell personal data or use institutional user data for third-party advertising or marketing profiling unrelated to the subscribed educational Service.

7. How Personal Data Is Made Available or Entrusted

We do not sell, rent, or trade personal data. As processor, we do not “share” student data for unrelated commercial purposes. Data flows as follows:

7.1 Visibility Within Your Institution (Controller’s Organization)

Lab completions, assessment scores, progress metrics, and related analytics are available only to authorized users (e.g. instructors and administrators) within your institution’s tenant, as configured by the controller. This visibility is the core function of the platform for education oversight. The institution defines who may see which data; our role is to enforce tenant isolation and role-based access in the product.

7.2 Sub-processors Engaged by Pi tech (Processor’s Processors)

Pi tech uses the following sub-processors to host and operate the Service on behalf of our institutional customers. Each relationship is governed by Article 28 GDPR and our agreements with the controller; sub-processors are bound by contract to process data only on documented terms:

We maintain an up-to-date list of sub-processors for institutional customers and their DPOs. Request the current list at [email protected].

7.3 Law Enforcement or Regulatory Authorities

We may disclose information where required by EU or Member State law, by a lawful request, or to protect vital interests, consistent with Article 28(3)(a) and our obligations as processor. Where feasible, we will direct such requests to the Data Controller unless prohibited by law.

7.4 Business Transfers

If Pi tech undergoes a merger, acquisition, or asset sale, processing of personal data will continue only under terms that preserve controller and data subject rights, and institutional customers will be notified as required by contract and law. End users may receive notice where appropriate.

8. Your Rights Under the GDPR

As a data subject, your rights under the GDPR (access, rectification, erasure, restriction, portability, objection, etc.) are exercised primarily in relation to the Data Controller — your institution — which determines the purposes of processing.

Response timelines follow Article 12 GDPR as implemented by the controller; Pi tech supports timely responses as required under Article 28(3)(e).

Verification: The controller (and Pi tech when assisting) may request identity verification to prevent unauthorized disclosure.

Complaints to a supervisory authority: You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement — often your institution’s lead supervisory authority or the Hellenic Data Protection Authority (HDPA) for processing in Greece:

Hellenic Data Protection Authority (HDPA)
Kifisias 1-3, 115 23 Athens, Greece
Phone: +30 210 6475600
Website: https://www.dpa.gr
Email: [email protected]

9. Automated Decision-Making and Profiling

This section describes the automated processing the Service performs. Whether any of it produces legal effects concerning you, or similarly significantly affects you within the meaning of Article 22 of the GDPR, depends on how your institution — as controller — uses the results, for example whether a quiz score carries academic weight. Where it does, the rights described in Section 8 apply, and we support your institution in honouring them.

• Automated grading of quizzes: Quiz answers are scored by the platform automatically, with no human in the loop. The comparison is deterministic — each answer is matched against the answer key your instructor set for that question — and no AI model takes part in producing the score. The platform also computes a pass or fail result against the passing threshold set for that assessment. The platform does not currently provide instructors with a way to change a score once it has been recorded. If you believe a score is wrong, contact your instructor or your institution, who can raise it with us.

• AI-derived learning profile (profiling): VICKY uses an AI model to derive, from your conversations and training activity, a per-topic picture of what you appear to have understood and where you appear to be struggling — including an estimated mastery level, a confidence score, key facts, and weak areas. This picture is stored against your account and is fed back into VICKY's prompt, so it shapes the guidance VICKY gives you next. This is profiling within the meaning of Article 4(4) of the GDPR. It is not used to grade you and does not contribute to the score described above. Within the platform only you can see this picture; your institution's administrators and instructors cannot. Pi tech's super-administrators can retrieve it with the platform's personal-data export, and Pi tech staff with database-administrator access can read it.

  VICKY also derives a second, separate profile about how you learn rather than what you know — an estimated expertise level, a preferred learning style, the topics you ask about, and simple measures of how you use VICKY (questions per session, how often you follow up or ask for clarification). It is used to pitch VICKY's explanations at the right level. Like the picture above, within the platform only you can see this profile; your instructors and administrators cannot. Pi tech's super-administrators can retrieve it with the platform's personal-data export, and Pi tech staff with database-administrator access can read it. It contains no assessment of your competence and never affects a grade.

• AI-generated content: VICKY generates lessons and chat responses using AI models. These outputs are educational content, not decisions about you.

• Progress analytics: The platform computes metrics (completion rates, practice frequency) from your training data. These metrics inform your instructors.

• Entitlement and access checks: The platform automatically verifies your enrollment and role to determine which content you can access. This is a contractual necessity, not a decision based on profiling.

10. Data Retention

Pi tech retains personal data only as long as necessary to provide the subscribed Service and in line with the controller’s instructions and our DPA, unless a longer period is required by law. Institutional customers may define certain retention needs in their agreement; the table below reflects current platform defaults:

After the retention period expires, data is either permanently deleted or irreversibly anonymized so that it can no longer be associated with you.

11. Data Security

Pi tech implements technical and organizational measures appropriate to the risk, in accordance with Article 32 GDPR and our obligations as processor:

Technical measures:

• Encryption in transit: all communications between your device and our servers use TLS 1.2 or higher
• Encryption at rest: Supabase encrypts stored data at rest; authentication tokens on your device are stored in the secure enclave (iOS Keychain / Android Keystore)
• Row-Level Security (RLS): database-level policies enforce that each user can only access data they are authorized to see
• Tenant isolation: each institution's data is logically separated at the database level, preventing cross-tenant data access
• Access controls: role-based access control (RBAC) ensures that students, professors, and administrators have access only to the data relevant to their role

Organizational measures:

• Principle of least privilege: internal access to production data is restricted to authorized personnel only
• Data Processing Agreements: all sub-processors are bound by DPAs in accordance with Art. 28 GDPR
• Regular security reviews: we conduct periodic reviews of our security measures and access controls
• Incident response: we maintain a data breach response procedure (see Section 12)

12. Data Breach Notification

As processor, if we become aware of a personal data breach affecting data we process on behalf of a controller, we will:

1. Notify the affected Data Controller (the institution) without undue delay after becoming aware of the breach, in accordance with Article 33(2) and Article 28(3)(f) GDPR, providing information required to enable the controller to meet its Article 33(1) obligations toward supervisory authorities
2. Support the controller in assessing whether the supervisory authority and/or data subjects must be notified under Articles 33 and 34 GDPR
3. Document the breach and remediation measures as required by Article 33(5) and our DPA

Controllers are responsible for notifying the competent supervisory authority within 72 hours where required, and for communicating to affected data subjects when Article 34 applies. Pi tech will not unilaterally replace the controller’s statutory role in those notifications.

13. International Data Transfers

Your personal data is primarily stored and processed within the European Economic Area (EEA), specifically in Supabase's EU data center in Frankfurt, Germany (eu-central-1).

Where data is transferred to processors outside the EEA (see Section 7.2), we ensure that appropriate safeguards are in place in accordance with Chapter V of the GDPR:

• Standard Contractual Clauses (SCCs): adopted by the European Commission (Decision 2021/914), supplemented with a Transfer Impact Assessment (TIA) where required
• Adequacy decisions: where the European Commission has determined that the recipient country ensures an adequate level of data protection
• Additional technical measures: including encryption in transit, pseudonymization where feasible, and contractual restrictions on onward transfers

You may request a copy of the relevant transfer safeguards by contacting [email protected].

14. Cookies and Similar Technologies

Web Portal

The Vicky web portal uses strictly necessary cookies only:

• Authentication cookies: maintaining your login session
• Preference cookies: storing your language and display settings

These cookies are exempt from the consent requirement under the ePrivacy Directive (Directive 2002/58/EC, Art. 5(3)) because they are strictly necessary for the provision of the Service.

Inside the Vicky platform (after sign-in) we do not use analytics cookies, advertising cookies or tracking pixels. On the public pages of vickylabs.ai, and only if you accept analytics cookies in the cookie banner, we use Google Analytics 4 (Google Ireland Limited) to see how those pages are used, with advertising signals off and data kept for 2 months; you can change your choice at any time from «Cookie settings» at the bottom of every public page.

Cookies on the public pages.

• Strictly necessary (no consent needed): the sign-in session and the record of your cookie choice, set by us.
• Statistics (only after your consent): _ga and _ga_<id>, set by Google Analytics 4 (Google Ireland Limited) to count visits and see which pages are used. They stay on your device for 13 months unless you delete them or withdraw consent. Google's own privacy policy is at policies.google.com/privacy.

Ελληνικά: Μέσα στην πλατφόρμα Vicky (μετά τη σύνδεση) δεν χρησιμοποιούμε cookies ανάλυσης, cookies διαφήμισης ούτε pixel παρακολούθησης. Στις δημόσιες σελίδες του vickylabs.ai, και μόνο αν αποδεχτείς τα cookies ανάλυσης στο πλαίσιο για τα cookies, χρησιμοποιούμε το Google Analytics 4 (Google Ireland Limited) για να βλέπουμε πώς χρησιμοποιούνται αυτές οι σελίδες, με τα διαφημιστικά σήματα απενεργοποιημένα και διατήρηση των δεδομένων για 2 μήνες· μπορείς να αλλάξεις την επιλογή σου οποιαδήποτε στιγμή από τις «Ρυθμίσεις cookies» (Cookie settings) στο κάτω μέρος κάθε δημόσιας σελίδας.

Cookies στις δημόσιες σελίδες.

• Απολύτως απαραίτητα (δεν απαιτείται συγκατάθεση): η συνεδρία σύνδεσης και η καταγραφή της επιλογής σου για τα cookies, που ορίζονται από εμάς.
• Στατιστικά (μόνο μετά τη συγκατάθεσή σου): τα _ga και _ga_<id>, που ορίζονται από το Google Analytics 4 (Google Ireland Limited) για την καταμέτρηση των επισκέψεων και για να φαίνεται ποιες σελίδες χρησιμοποιούνται. Παραμένουν στη συσκευή σου για 13 μήνες, εκτός αν τα διαγράψεις ή ανακαλέσεις τη συγκατάθεσή σου. Η πολιτική απορρήτου της Google βρίσκεται στο policies.google.com/privacy.

Mobile and VR Applications

The mobile and VR applications do not use cookies or web-based tracking technologies. Usage telemetry is collected as described in Section 3.2 and processed under the legal bases described in Section 4.

15. Children's Privacy

The Service is designed for university-level health science education and is not directed at children. The Service is offered to users aged 18 and over; Vicky does not ask for a date of birth or check age.

If you are a parent or guardian and believe that your child has provided personal information to us, please contact us at [email protected]. If we become aware that we have collected personal data from a child below the applicable age without valid parental consent, we will take steps to delete that information promptly.

16. Links to Third-Party Services

The Service may contain links to third-party websites or services (for example, institutional websites or external educational resources). We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party service you access.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

• For minor changes: we will update the "Last updated" date at the top of this page.
• For material changes: we will provide a prominent notice within the Service (such as an in-app notification or banner) and, where required, seek your consent before the changes take effect.

We encourage you to review this Privacy Policy periodically. The current version will always be available at https://vickylabs.ai/privacy-policy.

18. Governing Law

This Privacy Policy is governed by and construed in accordance with the laws of the Hellenic Republic (Greece), including:

• Regulation (EU) 2016/679 (General Data Protection Regulation — GDPR)
• Greek Law 4624/2019 (transposing the GDPR and Directive 2016/680 into national law)
• Directive 2002/58/EC (ePrivacy Directive) as transposed into Greek law

Any disputes arising from or in connection with this Privacy Policy shall be subject to the exclusive jurisdiction of the courts of Thessaloniki, Greece.

19. Contact Us

Institutional customers (controllers): For DPA, sub-processor, transfer mechanism, or breach coordination inquiries — [email protected].

End users (students, staff): For rights requests, contact your institution’s data protection contact first; you may copy [email protected] so Pi tech can assist the controller as processor.

Pi Private Company (Π ΙΔΙΩΤΙΚΗ ΚΕΦΑΛΑΙΟΥΧΙΚΗ ΕΤΑΙΡΕΙΑ) — VAT EL801289442
Processor / privacy contact: [email protected]
Phone: +30 23120 02793
Registered office: K. Karamanli 67, 546 42 Thessaloniki, Greece
GEMI number: 153620048000
Website: https://pi-tech.gr

Supervisory Authority: Hellenic Data Protection Authority (HDPA) Kifisias 1-3, 115 23 Athens, Greece Phone: +30 210 6475600 Email: [email protected] Website: https://www.dpa.gr

Appendix A: Additional Rights for Users in Other Jurisdictions

California (USA) — California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA)

If you are a California resident using the Service under an institutional subscription, your school or university is typically the business responsible for CCPA notices and rights for student data; Pi tech acts as a service provider / processor under contract. You may exercise CCPA rights through your institution and via [email protected] for requests we can fulfill as service provider.

Rights (summary): know, delete, correct, opt out of sale/sharing (we do not sell personal information or share it for cross-context behavioral advertising), non-discrimination.

Categories of personal information that may be processed through the Service (CCPA categories): identifiers (name, email), education information, internet/electronic network activity (usage telemetry), professional or employment information (institutional role). Precise geolocation is collected only during a field session that the user starts with location sharing switched on, for the institution's training record; it is never used for advertising, profiling or tracking.

Ελληνικά — ακριβής γεωγραφική θέση: Η ακριβής γεωγραφική θέση συλλέγεται μόνο κατά τη διάρκεια συνεδρίας πεδίου που ξεκινά ο ίδιος ο χρήστης με ενεργοποιημένη την κοινοποίηση τοποθεσίας, για το εκπαιδευτικό αρχείο του ιδρύματος. Δεν χρησιμοποιείται ποτέ για διαφήμιση, δημιουργία προφίλ ή παρακολούθηση.

Sale / sharing: We do not sell personal information. We do not share personal information for cross-context behavioral advertising.

United Kingdom — UK GDPR

If you are in the United Kingdom, your rights under the UK General Data Protection Regulation (UK GDPR) mirror those described in Section 8 of this policy. The competent supervisory authority for UK users is the Information Commissioner's Office (ICO): https://ico.org.uk.

Brazil — Lei Geral de Proteção de Dados (LGPD)

If you are in Brazil, your rights under the LGPD are substantially similar to those described in Section 8. The competent authority is the Autoridade Nacional de Proteção de Dados (ANPD).

This privacy policy covers all Vicky surfaces: the web portal, the VR application (Meta Quest), and the mobile application (Android and iOS). The web portal, VR application and Android application are currently in production; the iOS application is not yet available on the App Store.

Ελληνικά: Η παρούσα πολιτική απορρήτου καλύπτει όλες τις επιφάνειες της Vicky: τη διαδικτυακή πύλη, την εφαρμογή VR (Meta Quest) και την εφαρμογή για κινητά (Android και iOS). Η διαδικτυακή πύλη, η εφαρμογή VR και η εφαρμογή Android είναι ήδη σε παραγωγή· η εφαρμογή για iOS δεν είναι ακόμη διαθέσιμη στο App Store.

*Pi tech acts as Data Processor under Article 28 GDPR for personal data processed in the Service on behalf of subscribing educational institutions, which act as Data Controllers for their students’ and staff data. This document does not replace the institution’s own privacy notices or the parties’ Data Processing Agreement.*