Privacy Risks in Virtual Reality for Healthcare and Therapy: Challenges, Regulatory Governance, and Mitigation Strategies

Virtual reality (VR) is increasingly used in healthcare for surgical training, rehabilitation, and psychotherapy, generating high-frequency “immersive telemetry” from user behaviour and, in some cases, physiological sensing. Such data may reveal sensitive clinical and non-clinical attributes. This structured narrative review synthesizes literature published from 2021 through October 2026 on privacy risks in healthcare and therapy-oriented VR, emphasizing data collected in clinical and home deployments, threats across the data lifecycle, and technical, organizational, and governance mitigations. Four recurring risk drivers were identified: sensitivity and identifiability of immersive telemetry; re-identification, profiling, and inference from non-traditional health data; limitations of informed consent and transparency in vendor and third-party analytics pipelines; and heightened exposure in telehealth and home settings. Analysis of GDPR and HIPAA highlights tensions around data minimization, purpose limitation, and accountable data sharing. Proposed safeguards include encryption and access control, privacy-preserving analytics, local or edge processing, and governance controls, but no single measure provides end-to-end protection. Healthcare VR therefore requires lifecycle-based privacy risk assessment, clearer governance of immersive telemetry and third-party processing, and interdisciplinary design integrating clinical, technical, and regulatory perspectives.