Vesti Rehab App

Privacy Policy

Last updated: 31 October 2026

In short

Vesti Rehab connects the headset and the remote control over the local network. Preferences and associations are stored on the devices; commands and current results are exchanged locally, encrypted once the device is paired. No patient account is required and no session history is kept.

This policy can also be read in the application: in the headset (Settings › Privacy) and in the remote control (Settings › Privacy).

1. Who publishes the application

Vesti Rehab is published by Vesti Rehab Belgium. Contact: vestirehab@gmail.com

2. Session data

Vesti Rehab does not request a patient account or a named patient record. Settings, commands, states and current session results are exchanged between the headset and the remote control over the local network. The application keeps no session history: the results are cleared as soon as the headset returns to the home screen. The healthcare professional is responsible for recording relevant results in their own patient file.

3. Data stored on the devices

To retain settings and associated devices, the application stores locally:

  • on the headset: language and exercise preferences, the headset name and identifier, and the registry of associated devices, including their names, identifiers, categories, permissions and connection tokens;
  • in the remote control: the language, the list of known headsets and their connection information;
  • on PC: the association token in the browser's local storage, or in the profile folder of the remote control for Windows; on native mobile: the token in the application's secure storage, with a temporary handoff through the remote control window's session storage.

The website's "My headset" page keeps only, in the visitor's browser, the chosen language and the last three headset addresses entered. This information is not sent anywhere; the page uses no cookies and no audience measurement tools.

Freely entered device names may contain identifying information. Association authorises a connection between devices; it is not a patient account.

4. Local network, encryption and video preview

The remote control communicates with the headset over the local network for device discovery, association, commands, settings and current session results. The Internet permission is used for these local exchanges. The implemented operation does not depend on any remote server.

To be found, the headset announces its name, its identifier and the application version on the local network: any device connected to the same network can read them. Choose a headset name that does not identify a patient.

The remote control page is served by the headset over HTTP, without encryption. The pairing request (device name, public keys and the 4-digit code shown on both sides) is also sent in clear. Once the device is paired, commands, settings and results are end-to-end encrypted between the headset and that device.

On request, a preview streams the exercise's virtual rendering to the remote control, encrypted by WebRTC. It transmits neither the headset camera footage nor audio, and the application does not record it. No external server (STUN/TURN) is used for this stream.

Report a problem. This remote control button opens your email app with a message addressed to Vesti Rehab (vestirehab@gmail.com). The message contains: the device type, the headset name and the start of its identifier, the connection state, the current exercise and its step, the language and the technical description of the browser or system. No session results are included. Nothing is sent until you press "Send" yourself in your email app; the message is used only to analyse and fix the reported problem.

This description covers functions implemented by Vesti Rehab. It does not verify all data that may be processed by the headset operating system or third-party SDKs.

5. How to delete this data

  • Removing a device from the headset's associated devices revokes its association.
  • Forgetting a headset in the remote control removes its local entry and requests revocation of the association. If the headset is unavailable, the request is retried when it is discovered again.
  • To remove other local preferences, clear the application data on each relevant device and the site data in the PC browser. Exercise settings return to their default values for every exercise; this does not delete associations or remote control data.
  • A message sent with "Report a problem" is deleted on simple request to vestirehab@gmail.com.
  • Uninstalling the remote control for Windows leaves its profile folder in place: delete it as well (%APPDATA%\vesti-rehab-companion).
  • On the "My headset" page, the "Forget addresses" button clears the stored addresses; clearing the site data in the browser also clears the chosen language.

For a question or request regarding your data, write to vestirehab@gmail.com; we reply within 30 days.

6. Children

Vesti Rehab is not intended for children and does not knowingly collect any data concerning them.

7. Changes to this policy

Should the application ever start storing or transmitting other information, this page will be updated before the release of the version concerned, and the last-updated date above will be changed.

8. Contact us

vestirehab@gmail.com