Acceptable Use Policy

1. Status, scope, and amendment

1.1 This ORamaVR Acceptable Use Policy (the “AUP”) is an ORamaVR Standard-Form Document, identified as ORM-AUP-001, and is published at oramavr.com/legal/aup. It is incorporated by reference into every ORamaVR product agreement that involves access to ORamaVR products, services, or infrastructure, including the VTC End Customer Terms (Exhibit B), the Creator Pro End-User Licence Agreement, the Creator Solo Terms, the SIM Library End User Licence Agreement, the JARIA Terms of Use, the CMDA, the Reseller Agreement, and any OEM-tier or Direct MSA.

1.2 ORamaVR may amend the AUP unilaterally in accordance with the Standard-Form Document Amendments mechanism in the relevant Principal Agreement.

1.3 In this AUP, “User” means any natural or legal person who accesses or uses an ORamaVR product, service, or infrastructure under or through any ORamaVR agreement, including Authorised Users, End Customers, Authorised Channel Partner personnel, Reseller personnel, and end users of any Derivative Work.

1.4 This AUP applies to all use of ORamaVR products and services regardless of the contracting path (Direct, Reseller, or CMDA).

2. Permitted use

Users may use ORamaVR products and services for their intended purposes as set out in the applicable product agreement, namely: development of XR training simulations and Derivative Works (Creator); delivery of XR training simulations to learners (VTC, SIM Library, Custom SIM Service); access to AI co-pilot and AI assistant features in accordance with their respective terms (OMEN within Creator; JARIA within VTC).

3. Prohibited content

Users shall not develop, deploy, distribute, store, or transmit through any ORamaVR product or service any content that:

• (a) is unlawful, defamatory, obscene, pornographic, or harmful to minors;
• (b) incites violence, terrorism, or hatred against any person or group;
• (c) infringes any third party's intellectual property rights, including copyright, trademark, patent, trade secret, or moral rights;
• (d) violates any third party's privacy or publicity rights, including unauthorised use of personal data;
• (e) contains malware, viruses, worms, Trojan horses, ransomware, or any other malicious code;
• (f) contains content designed to deceive learners or end users in a manner that could result in physical harm, including the deliberate misrepresentation of clinical procedures, drug dosages, or surgical techniques;
• (g) contains content that breaches medical-ethics standards applicable in the jurisdiction of the User or the intended end users.

4. Prohibited behaviours

Users shall not:

• (a) reverse-engineer, decompile, or disassemble any ORamaVR product, except to the extent expressly permitted by mandatory applicable law;
• (b) use ORamaVR products to develop, train, fine-tune, or evaluate a competing artificial intelligence model or simulation product;
• (c) probe, scan, or test the vulnerability of any ORamaVR system, or attempt to bypass or circumvent any security mechanism, except under an authorised security-testing engagement with ORamaVR's prior written consent;
• (d) use ORamaVR products in a manner that overwhelms or attempts to overwhelm the capacity of ORamaVR systems (denial-of-service, distributed denial-of-service, abusive automation);
• (e) share, sell, lease, or transfer User credentials or licences to any third party not entitled to use them under the applicable product agreement;
• (f) use any automated mechanism (scripts, bots, scrapers) to access ORamaVR products or services without ORamaVR's prior written consent;
• (g) use ORamaVR products to send unsolicited commercial communications (spam);
• (h) misrepresent the identity, authorisation, or organisational affiliation of the User;
• (i) use ORamaVR products in any manner contrary to applicable law, including export-control law, sanctions regimes, and data-protection law.

5. Special rules for AI components (OMEN and JARIA)

5.1 Users shall not submit to OMEN or JARIA, as input prompts, parameters, or context: (a) sensitive personal data of identifiable individuals without lawful basis under applicable data-protection law; (b) confidential information of third parties without authority to share it; or (c) content designed to extract, mimic, or reproduce ORamaVR's underlying AI models, training data, or system prompts.

5.2 Users shall apply appropriate human judgement before relying on AI-generated outputs in any clinical, educational, or professional decision. AI-generated content is provided on an as-is basis under the disclaimers in the applicable product agreements.

5.3 Users shall not represent AI-generated content as having been produced by a human, where the context of use would mislead a reasonable recipient.

6. Fair-usage limits

6.1 VTC Platform fair-usage limits

• Concurrent User (CCU) ceiling — as published in Schedule P for the relevant tier. Overage handled by add-on pack purchase or tier upgrade.
• Storage per Client Tenant — not applicable. VTC operates on a CCU floating-licence model; simulations are hosted and sized by ORamaVR. Customer-generated data (analytics, session records, learner rosters, IFU PDFs uploaded to JARIA) are governed by the fair-usage narrative in this Section and by ORamaVR's infrastructure capacity; no per-tier storage cap applies.
• Authorised User count per Client Tenant — unlimited. The number of registered Authorised Users per Client Tenant is not capped. Only concurrent active sessions (CCUs) are constrained, in accordance with the number of CCUs the End Customer has licensed.
• API rate limits — not applicable. The ORamaVR platform API is not publicly exposed in the Creator or VTC tiers. API access, where made available under a future Developer or OEM tier, will be subject to rate limits published at that time.

6.2 SIM Library fair-usage limits

• Per-SIM, per-organisation, per-year licensing as published in Schedule LIB. No volume cap on the number of SIM Library titles an organisation may subscribe to.
• Concurrent session limit per SIM — aligned with the number of CCUs the End Customer has licensed. No additional per-SIM session limit is imposed beyond the End Customer's CCU entitlement.

6.3 Creator Pro fair-usage limits

• Authorised Users per seat — one (1) Authorised User per seat, named, non-transferable except as permitted under EULA §6.
• OMEN prompt quota — text prompts: unlimited per seat per month. Image generation: 30 generated images per seat per month (hard cap; throttle on overage; no automatic charge).
• Asset Library download volume — unlimited. No cap applies to the volume of Medical 3D Asset Library content downloaded per Creator Pro seat per month.
• Derivative Work compile / build volume — unlimited. No cap applies to the number of Derivative Work compiles or builds per Creator Pro seat per month.

6.4 Educational tier — anti-arbitrage

• The VTC Educational tier is reserved for accredited academic institutions and non-commercial research and teaching only. Use of the Educational tier to deliver clinical training to fee-paying clinical participants is prohibited, regardless of the institutional status of the User. This restriction is in addition to the eligibility provisions in Schedule P §3.2.
• Creator Solo (free) tier — usage at this tier by entities with annual revenue exceeding EUR 150,000 in the previous fiscal year is prohibited; such entities must upgrade to Creator Pro.

6.5 General anti-abuse threshold

• ORamaVR reserves the right to investigate and remediate usage patterns that are materially inconsistent with the size, stated purpose, or permitted use of the Licensee's subscription, in accordance with the tiered enforcement mechanism in §8.

7. Data protection and security obligations of Users

7.1 Users shall comply with applicable data-protection law (GDPR in the EEA; revFADP in Switzerland; equivalent applicable legislation in other jurisdictions) when collecting, using, or transmitting personal data through ORamaVR products and services.

7.2 Users shall maintain reasonable security of their credentials, including strong passwords, multi-factor authentication where supported by ORamaVR products, and prompt revocation of credentials of departing personnel.

7.3 Users shall not knowingly upload to ORamaVR products: special-category personal data (Article 9 GDPR), data of children, or other categories of sensitive personal data, except where the data subject has provided lawful consent and the upload is for a lawful purpose within the scope of the applicable product agreement.

7.4 Users shall notify ORamaVR promptly (within 24 hours of becoming aware) of any actual or suspected security incident involving ORamaVR products or User credentials at security@oramavr.com.

8. Compliance and enforcement

8.1 Investigation

ORamaVR may investigate suspected violations of this AUP. Investigation may include log review, telemetry analysis, and (subject to applicable confidentiality protections) review of content stored within the User's tenant on the VTC Platform. ORamaVR shall conduct any investigation proportionately and with respect for User privacy, and shall not exceed what is reasonably necessary to confirm or refute the suspected violation.

8.2 Tiered enforcement response

ORamaVR's enforcement response is graduated to the severity of the violation:

• (a) Minor or first-time violations: written warning to the User and Licensee, with a request to remediate within a stated period (typically 7–30 days).
• (b) Repeated or material violations: temporary suspension of access to the affected product or feature, in addition to a written warning.
• (c) Serious violations (including unlawful conduct, security breaches, malware deployment, deliberate misrepresentation, or abuse of AI components): immediate suspension of access without prior warning, pending investigation; potentially leading to termination of the underlying agreement under its terms.
• (d) Violations that constitute a criminal offence or that have caused material harm to ORamaVR, other Users, or third parties: termination of the underlying agreement, reservation of all civil and criminal remedies, and (where appropriate) notification of competent authorities.

8.3 Suspension and termination

Suspension or termination under this §8 is in addition to, and not in lieu of, any other remedy available to ORamaVR under the relevant product agreement or applicable law.

9. Reporting violations

Suspected AUP violations may be reported to ORamaVR at abuse@oramavr.com. ORamaVR shall acknowledge a credible report within five (5) business days and shall investigate proportionately.

ORamaVR SA · CHE-478.871.980 · Standard-Form Document
ORM-AUP-001 · Version 1.0 · oramavr.com/legal/aup