1.1 This Policy applies to a demand for:

• Customer Data held in a hospital's tenant: clinical, administrative or financial records.
• Business contact, account, access-log or audit data Pensieve holds as a Data Fiduciary (POL-GL-053 clause 2.2).
• Trust Center access records.
• Subscriber and know-your-customer records Pensieve retains under Direction (v) of the CERT-In Directions of 2022.
• Technical assistance: decryption, interception, preservation, or the production of logs.

1.2 It covers demands from: a court or tribunal; a police or investigating authority; a regulator; a tax authority; a data protection authority; a health authority; a national computer emergency response team; and a foreign authority proceeding through a lawful channel.

1.3 It does not cover: a civil discovery request between private parties, which is answered under MSA-IN-001 clause 27 and referred to the customer; a request from a patient or a Data Principal, which is POL-GL-053 and POL-GL-066; or a request from a hospital about its own tenant, which is ordinary support.

1.4 Pensieve's own regulatory reporting (CERT-In incident reporting under Direction (ii) of the CERT-In Directions of 2022, and personal data breach reporting) is not a law enforcement request. It is DIS-GL-016 and it happens on Pensieve's own initiative.

2.1 Address for service.

2.2 What a request must contain. Without these, Pensieve cannot act and will say so:

2.2.1 the issuing authority, the officer's name, designation and official contact details;

2.2.2 the legal power relied on, cited by statute and provision;

2.2.3 the specific data sought, identified by account, tenant, individual, date range and data type, not "all data relating to";

2.2.4 the purpose, and how the data sought is relevant and proportionate to it;

2.2.5 the date by which a response is required;

2.2.6 whether notification to the affected customer or individual is prohibited, and if so under which provision and for how long; and

2.2.7 a secure channel for delivery.

2.3 What Pensieve will not act on. An oral request; an email from a non-official address; a request with no identified legal power; a request from a foreign authority that has not proceeded through a mutual legal assistance channel or another lawful route (8); a request for bulk or indiscriminate access; and a request to create data that does not exist.

2.4 Preservation. Pensieve will act on a lawful preservation request without waiting for the production order, because preserving is less intrusive than disclosing. A preservation is time-limited, recorded, and does not itself authorise disclosure.

3.1 The rule. Where a demand seeks records inside a hospital's tenant, Pensieve's first action is to tell the authority that the hospital is the Data Fiduciary, that the hospital holds and controls those records, and that the authority should direct the demand to the hospital.

3.2 Why. The hospital determines the purposes and means of that processing. It holds the clinical context, knows what is privileged or statutorily protected, and is the party the law places the obligation on. It is also better placed than Pensieve to judge whether a record is a medico-legal record, whether a statutory confidentiality applies, and whether a narrower production would satisfy the demand.

3.3 What Pensieve does not do. Pensieve does not volunteer a hospital's records to an authority that has not asked the hospital, and does not treat a demand addressed to Pensieve as permission to search a tenant.

3.4 Where the authority insists. If the authority declines to redirect, or is legally entitled to proceed against Pensieve, 4 applies.

4.1 One owner. Every demand is handled by the named legal owner. A Pensieve engineer, support agent or salesperson who receives a demand must route it to info@pensievelabs.org immediately and must not respond, must not confirm whether an account exists, and must not run a query. This is a disciplinary matter, and it is trained.

4.2 No production without sign-off. A disclosure requires the written sign-off of the Director. There is no self-service path by which any Pensieve person can extract and hand over customer data.

5.1 The default is notice. Pensieve notifies the affected customer before disclosing, with enough detail and enough time for the customer to seek its own legal advice and to challenge the demand itself.

5.2 Where notice is prohibited. Where a court order or a statute prohibits notification, Pensieve:

5.2.1 complies with the prohibition;

5.2.2 asks the authority to lift or narrow it, and records the request and the answer;

5.2.3 notifies the customer as soon as the prohibition ends or expires, without needing to be asked; and

5.2.4 counts the demand in the Transparency Report in the aggregate figures, where the law permits.

5.3 Where notice would create a risk. Pensieve may delay notice where notifying would create a risk of death or serious harm, or would defeat an investigation into a risk to a child. It records the reason and notifies as soon as the risk passes.

5.4 What Pensieve will not do. Pensieve will not agree to a voluntary non-disclosure undertaking that is not compelled by law, and will not accept a request "not to tell the customer" that has no legal basis.

5.5 Where a prohibition applies to the report itself. Where Pensieve is prohibited from reporting even an aggregate number, it states that a prohibition applies rather than reporting zero. A silent zero is a misleading statement.

6.1 The narrow path. Where an authority states that there is an imminent risk of death or serious physical harm to a person, and that the delay of ordinary process would create that risk, Pensieve may disclose the minimum data necessary to address the emergency without the full process at 4.

6.2 Conditions. The request must be in writing, from an official address, state the nature of the emergency, identify the person at risk, and identify the specific data sought. Pensieve authenticates the requesting office before disclosing. The Director signs off.

6.3 Afterwards. Pensieve records the disclosure, notifies the affected customer within 5 Business Days unless prohibited, asks the authority to follow up with ordinary legal process, and counts the disclosure separately in the Transparency Report.

6.4 Not a route around 4. An emergency is an imminent risk to life, not urgency, not convenience, and not an approaching deadline in an investigation.

An authority is entitled to know, and a hospital is entitled to know, that the answer differs.

7.1 What Pensieve holds in every model. Business contact data, contract and billing records, the customer know-your-customer file, Trust Center access records, and support correspondence. Those are Pensieve's own records and a valid demand can reach them.

7.2 Encryption and key custody. Where customer data is encrypted with keys the hospital controls, Pensieve cannot produce plaintext and will say so. Key custody by model is in DIS-GL-011.

7.3 Log localisation. ICT system logs are retained within Indian jurisdiction as Direction (iv) of the CERT-In Directions of 2022 requires, and are producible to CERT-In on a valid direction. The configuration is in DIS-GL-034.

8.1 The rule. Pensieve does not disclose data to a foreign authority on the strength of that authority's own domestic process alone. A foreign demand must proceed through a mutual legal assistance treaty, a letter rogatory, or another route that produces a demand enforceable against Pensieve in the jurisdiction where it holds the data.

8.2 Why. Complying with a foreign demand outside a lawful channel would breach Pensieve's obligations to its customer, may breach Indian law, and, where the General Data Protection Regulation applies, engages Article 48, which provides that a judgment or decision of a third-country authority is enforceable only on the basis of an international agreement.

8.3 Rule 15 and foreign States. Rule 15 of the Digital Personal Data Protection Rules, 2025 addresses making personal data available to a foreign State, or to a person or entity under the control of or an agency of such a State. Pensieve treats a foreign authority demand as engaging that rule and applies 8.1.

8.4 Where a customer is in another market. A demand from the authority of the market in which the customer operates (Australia, Denmark, Norway or the United Arab Emirates) is handled under this Policy with that market's process substituted, and the customer is notified under 5.

9.1 No back door. Pensieve grants no public authority direct, indirect, blanket, bulk or standing access to Customer Data or to the systems on which it is processed, and has not been asked to. Pensieve has built no mechanism by which such access could be given without the process at 4.

9.2 No weakened cryptography. Pensieve has not weakened, and will not weaken, any cryptographic control to facilitate access, and has not been asked to.

9.3 The honest limit. Pensieve cannot undertake to defeat a lawful order of a court or authority of competent jurisdiction, and does not undertake it here. Indian law contains compulsion powers, including under section 69 of the Information Technology Act, 2000 and the rules made under it, section 5(2) of the Indian Telegraph Act, 1885, the production powers of the criminal procedure statute, and section 70B(6) of the Information Technology Act, 2000 in relation to CERT-In directions. Comparable powers exist in every market Pensieve serves. A vendor that claims otherwise is not being straight with you.

9.4 What actually determines the exposure. Not the promise, but the architecture: what data exists, where it is held, who holds the keys, how narrowly access is scoped, and how much is logged. That is why Pensieve's answer to this question is a deployment-model conversation (see WPR-GL-004), and why the technical measures in DPA-GL-001 clause 12.5 and DIS-GL-033 matter more than this clause does.

9.5 If Pensieve is ever compelled to change this position, the change will appear in this document and in the Transparency Report to the extent the law permits, and where it does not permit it, 5.5 applies.

10.1 Costs. Pensieve does not charge a customer for responding to a demand about that customer's data. Where the law entitles Pensieve to recover the cost of production from the requesting authority, it may.

10.2 Records. Every demand is recorded, received, authenticated, reviewed, redirected, narrowed, challenged, disclosed or refused, with the authority, the power, the scope, the decision, the reasoning and the outcome. Records are retained for 8 years.

10.3 Customer access to the record. A customer may request the record of demands relating to its own tenant at any time, at no charge, subject only to a prohibition under 5.2.

10.4 Transparency Report. Pensieve publishes, in POL-GL-068, at the level of aggregation the law permits: the number of demands received, by type and by authority category; the number redirected to the customer; the number challenged, and the outcome; the number complied with in whole or in part; the number refused; the number of customers affected; and the number of emergency disclosures. Where a prohibition prevents reporting a figure, the report says a prohibition applies.

10.5 Zero is reported as zero, with a denominator. Where Pensieve has received no demands in a period, it says so, states the period, and states the date the statement was made. A trust centre that never updates this figure is not reporting it.

Review. This Policy is reviewed annually, on any change to the compulsion powers in a market Pensieve serves, and after any demand that reveals a gap. The review date is 31 January 2027.