Meduverse Privacy Policy

Last updated: 14 July 2026

This Privacy Policy explains how FPT Information System (FIS) ("we", "us", "FIS") processes personal data when a student uses the Meduverse mobile application (the "App"), an English-learning game for school children. Where consent is required, it will be obtained separately from the appropriate parent, guardian, school, or user.

1. Who the App is for

Meduverse is provided to students through partner schools. User accounts are created and issued by the school; children do not register accounts themselves. The school, together with the parent or legal guardian, authorizes a child's use of the App and provides any required consent. The specific responsibilities of the school and FIS in handling personal data are defined in the agreement between FIS and each partner school.

2. Information we collect

• Account information (provided by the school): username, full name, email address (if provided by the school), and the user's role.
• Learning and game activity: lesson and quiz progress, achievements, level, in-game currency and rewards, and activity history with timestamps.
• Login credentials: the authentication token issued at sign-in, stored securely on the device.
• Device identifier: a device identifier provided by the operating system (the Android ID on Android, or the Identifier for Vendor on iOS) is used solely for authentication — to secure sign-in and keep the session valid. It is not an advertising identifier and is not used for advertising, profiling, or cross-app tracking.
• Voice / microphone: in speaking-practice activities, the App records a short audio sample from the microphone. This audio is processed entirely on the device (offline speech-to-text) to check pronunciation. Both the audio and the resulting text stay on the device; the pronunciation result is shown locally in the App.

3. What we do NOT collect

The App does not collect or use any of the following:

• Location / GPS data
• Camera images, photos, or facial data
• Contacts, SMS, or call logs
• Advertising identifiers or third-party advertising
• Third-party analytics, tracking, or attribution SDKs
• Payment or financial information

4. How we use information

• To authenticate the user and keep the account session secure.
• To deliver learning content and record the learner's progress and results.
• To operate, maintain, and support the App's educational features.
• To comply with applicable legal obligations.

We do not sell personal data, and we do not use personal data for advertising.

5. Microphone and voice data

The App requests microphone access only to enable speaking-practice activities. Voice audio is never uploaded to or stored on our servers. It may exist temporarily in device memory or temporary local storage solely while pronunciation is being checked, and is deleted immediately after processing. The speech recognition runs on the device; no audio, transcript, or pronunciation result is transmitted to our servers or shared with any third party. You may deny or revoke microphone permission in your device settings at any time; only the speaking-practice activities will be affected.

6. Children's privacy

Meduverse is intended for use by school children under the direction of their school and with the involvement of a parent or legal guardian. Because accounts are provisioned by the school, we rely on the school and the parent/guardian to authorize each child's participation. We collect only the information necessary to provide the educational service and do not knowingly collect personal data from children beyond what is described in this Policy. Parents, guardians, or schools may request access to, correction of, or deletion of a child's data as described in Sections 8 and 10.

7. Data storage and international transfer

Personal data collected from users in the Philippines is transferred to and processed on servers located in Vietnam. We apply contractual, organizational, and technical safeguards to protect the data during transfer and storage. Credentials and authentication tokens on the device are kept in the platform's secure storage. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Data retention and deletion

Account and learning-progress data are retained while the student's account remains active and managed by the school for its educational purpose. When the school disables an account, or upon a valid request from the school, parent, or guardian, the associated personal data is deleted. Requests to delete data can be made through the student's school or by contacting us at support@meduverse.ai. Data may be retained longer only where required by law or necessary to resolve security incidents or legal claims.

9. Data sharing

We do not sell personal data or disclose it to third parties for their own advertising, profiling, or independent commercial purposes. We may disclose data only:

• to the student's school, as the party that administers the accounts;
• to contracted service providers that process it only on our instructions to host, secure, or maintain Meduverse, under contractual obligations to protect the data with safeguards equivalent to those in this Policy; and
• where required by law or a valid request from a competent authority.

10. Your rights

Subject to applicable law, you (or a parent, guardian, or school on a child's behalf) may:

• be informed about how personal data is processed;
• access and correct personal data;
• request deletion of personal data;
• object to or request restriction of processing, where applicable;
• request a copy of the data in a portable form, where applicable;
• withdraw consent (which may prevent continued use of the App); and
• lodge a complaint with the Philippine National Privacy Commission (NPC).

Requests can be made through the student's school or by using the contact details in Section 13. To protect the account, we may take reasonable steps to verify the identity of the requester before acting on a request.

11. Applicable law

We process personal data in accordance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its implementing rules, which may apply even when data is processed outside the Philippines.

12. Changes to this Policy

We will notify the school and, where appropriate, parents, guardians, or users before material changes take effect, and will update the "Last updated" date above. Where required by law, we will obtain new consent before using personal data for a materially different purpose.

13. Contact

For privacy questions or requests, contact:
FPT Information System (FIS)
Email: support@meduverse.ai