In healthcare, the conversation about data protection usually centres on how to store information securely: encryption, access controls, audit logs. All of this is necessary. But there is an even more robust approach, and one often overlooked: not collecting the data at all.
It is a principle that GDPR itself enshrines: data minimisation. And in virtual reality for clinical use, it can be applied almost entirely.
The safest data is the data that doesn't exist
Every piece of personal data collected creates obligations: justifying the legal basis, ensuring security, defining retention periods, responding to access or erasure requests, and managing the risk of a potential breach. Health data adds even more demand, as it is a special category of data under GDPR.
So the right question at the start of any project is not "how will we protect this data?" but rather "do we really need to collect it?". Whenever the answer is no, all the downstream risk disappears.
There is no possible leak of data that was never collected. Minimisation is not just compliance: it is the simplest form of risk management.
The therapeutic function does not need to identify the patient
The value of a virtual reality for clinical use session (distraction, relaxation, comfort) does not depend on knowing who the patient is or recording their health data. The immersive experience works the same way without that collection.
The operational management that is needed (knowing which devices exist, their status, which service they are in) can be done at the device and service level, not the individual level. Separating fleet management from patient identity is what keeps the solution useful without turning it into a repository of clinical data.
What this simplifies in practice
- Smaller risk surface: less personal data means fewer points of exposure in a potential breach.
- Simpler to demonstrate compliance: data minimisation is an explicit GDPR principle, not an exception.
- Easier to earn trust: for the service and for the patient, "we do not collect your clinical data" is a clear, verifiable guarantee.
Important note: GDPR compliance is a shared responsibility between the solution provider and the healthcare institution using it. The approach described here reduces risk at the source, but does not remove each institution's organisational obligations regarding data processing.
The role of RVer
RVer is a virtual reality system designed for healthcare environments and registered as a Class I Medical Device (base product) in EUDAMED and with INFARMED (Portugal), bearing the CE mark under MDR 2017/745. It is built to work without collecting patient clinical data: a design choice that puts privacy at the centre, rather than treating it as an afterthought.
In healthcare, the most responsible technology is often the one that asks for the least. Protecting patient data starts by deciding, from the outset, not to collect it.
The questions the IT department usually adds to these are in “The eight questions hospital IT asks”.
On consent itself, see is consent required?.
Frequently asked questions
Does RVer collect patients' clinical data?
No. RVer is designed to work without collecting patient clinical data. This is a deliberate design decision: by not collecting personal clinical data, much of the risk associated with its processing and storage is eliminated at the source.
Why does collecting no data help with GDPR compliance?
GDPR applies to the processing of personal data. The less personal data (and in particular health data, which is a special category) a solution processes, the smaller the risk surface and the simpler it becomes to demonstrate compliance. Data minimisation is, in fact, a core principle of GDPR itself.
Can a VR medical device really work without patient data?
Yes. The therapeutic function (providing an immersive distraction or relaxation experience) does not depend on identifying the patient or collecting their health data. The operational management of the equipment can be done at the device and service level, not the individual level.