In healthcare, the conversation about data protection usually centres on how to store information securely: encryption, access controls, audit logs. All of this is necessary. But there is an even more robust approach, and one often overlooked: not collecting the data at all.
It is a principle that GDPR itself enshrines — data minimisation. And in virtual reality for clinical use, it can be applied almost entirely.
The safest data is the data that doesn't exist
Every piece of personal data collected creates obligations: justifying the legal basis, ensuring security, defining retention periods, responding to access or erasure requests, and managing the risk of a potential breach. Health data adds even more demand, as it is a special category of data under GDPR.
So the right question at the start of any project is not "how will we protect this data?" but rather "do we really need to collect it?". Whenever the answer is no, all the downstream risk disappears.
There is no possible leak of data that was never collected. Minimisation is not just compliance — it is the simplest form of risk management.
The therapeutic function does not need to identify the patient
The value of a virtual reality for clinical use session — distraction, relaxation, comfort — does not depend on knowing who the patient is or recording their health data. The immersive experience works the same way without that collection.
The operational management that is needed — knowing which devices exist, their status, which service they are in — can be done at the device and service level, not the individual level. Separating fleet management from patient identity is what keeps the solution useful without turning it into a repository of clinical data.
What this simplifies in practice
- Smaller risk surface — less personal data means fewer points of exposure in a potential breach.
- Simpler to demonstrate compliance — data minimisation is an explicit GDPR principle, not an exception.
- Easier to earn trust — for the service and for the patient, "we do not collect your clinical data" is a clear, verifiable guarantee.
Important note: GDPR compliance is a shared responsibility between the solution provider and the healthcare institution using it. The approach described here reduces risk at the source, but does not remove each institution's organisational obligations regarding data processing.
The role of RVer
RVer is an immersive virtual reality therapy system designed for healthcare environments and registered as a Class I Medical Device (base product) with Infarmed, bearing the CE mark under MDR 2017/745. It is built to work without collecting patient clinical data — a design choice that puts privacy at the centre, rather than treating it as an afterthought.
In healthcare, the most responsible technology is often the one that asks for the least. Protecting patient data starts by deciding, from the outset, not to collect it.
The questions the IT department usually adds to these are in the eight questions hospital IT asks.
On consent itself, see is consent required?.