1.1 Pensieve does not use the emergency route to avoid a notice period. Every use of it is recorded in DIS-GL-010 with the reason, and the count is published in the Transparency Report (POL-GL-068).

2.1 Two channels, always both. Every notice is sent by e-mail to each Customer's notified privacy contact and published in the Sub-Processor Change Log (DIS-GL-010). Publication alone is not notice.

2.2 Subscribing. A hospital may subscribe more than one address, and should subscribe a role address rather than a person. Subscription is managed from the Trust Center at https://trust.pensievelabs.org and does not consume a Trust Center credential under POL-GL-500. Prospective customers and their advisers may subscribe to the Change Log without a contract, because a buyer evaluating Pensieve is entitled to watch the list move before committing to it.

2.3 What a notice contains. The notice instrument is NTC-GL-002. It states the sub-processor and its country, what it will do, the categories of personal data involved, the processing location, the deployment models affected, what it replaces, why the change is being made, the effective date Notice subprocessor effective date, the objection deadline Notice subprocessor objection deadline, and the Change Log identifier. A notice that does not state the objection deadline is not a valid notice, and the period runs from a corrected notice.

2.4 Notice is given before the change, not with it. The thirty days run before the sub-processor begins to Process any customer personal data, not before the contract with it is signed.

3.1 Who and when. A Customer may object on reasonable data-protection grounds within fifteen (15) days of the notice, stating the grounds. Silence for fifteen days is acceptance (DPA-GL-001 clause 8.4).

3.2 What happens then, in this order:

3.2.1 Pensieve explains the sub-processor's role and the safeguards applied, within five Business Days. Most objections end here, because most are questions.

3.2.2 If the objection stands, Pensieve uses reasonable efforts to offer a configuration change or a commercially reasonable alternative that avoids the sub-processor Processing that hospital's personal data. Under DM-1 this is more often possible than under DM-2, and Pensieve will say which applies rather than leaving the hospital to guess.

3.2.3 If no alternative is available within thirty days, the Customer may terminate the affected Services without penalty, with a pro-rata refund of prepaid fees for the period after termination (POL-GL-063 R-2 route). That is the sole remedy for the objection.

3.3 Pensieve does not treat an objection as a commercial problem. An objection is answered by the person who owns the sub-processor decision under POL-GL-135, not by an account manager, and it is never used as a renewal or pricing lever (POL-GL-065 4.5).

3.4 Objections are logged. Every objection, its grounds and its outcome are recorded, and the aggregate count is published in the Transparency Report (POL-GL-068).

This is the most commonly misread part of Pensieve's architecture, and it is stated affirmatively.

4.1 Where the Platform connects to a third-party system using the hospital's own credentials, on the hospital's own authority, ABDM, NHCX, a payment gateway, an insurer or third-party administrator, an SMS or messaging provider, a laboratory analyser, a picture archiving system, the hospital's own e-mail tenant, that system is not a sub-processor of Edsol Edtech Pvt. Ltd.. The hospital is the party contracting with it. Pensieve holds the credential encrypted under ADD-GL-007 and calls the system as the hospital.

4.2 This is a deliberate architectural boundary, set out in DIS-GL-024, with responsibility allocated for ABDM and NHCX specifically in DIS-GL-026. It is why Pensieve does not hold, and does not claim, participant status in those networks.

4.3 Pensieve nonetheless publishes, in DIS-GL-009, the categories of such systems the Platform can connect to, so that a hospital's own privacy assessment is complete. The named instances for a given hospital are recorded in that hospital's ADD-GL-007 schedule.

5.1 No silent additions. Pensieve does not add a sub-processor and disclose it later. Where an addition is discovered to have been made without notice, Pensieve notifies immediately, treats it as an incident under POL-GL-112, records it in REG-GL-203, and the objection window runs from the late notice.

5.2 Flow-down. Every sub-processor is engaged under a written contract imposing obligations no less protective than DPA-GL-001, and Pensieve remains fully liable for its acts and omissions (DPA-GL-001 clauses 8.2 and 8.3).

5.3 Assessment before engagement. Every proposed sub-processor is assessed under POL-GL-135 and POL-GL-120 before engagement, and recorded in REG-GL-212. A change of sub-processor is a controlled change under RBK-GL-023.

5.4 Approval schedule. Where a hospital requires a named, pre-approved list rather than the general authorisation, that is recorded in the Subcontractor and Sub-Processor Approval Schedule (ADD-GL-022). A hospital that has taken that route is not bound by the deemed-acceptance rule in 3.1.

7.1 Reviewed quarterly with the Sub-Processor Register, under POL-GL-135 and POL-GL-502.

7.2 These Terms do not vary DPA-GL-001. Where a hospital has negotiated different notice or objection periods in its own DPA-GL-001, those periods govern for that hospital.