#A Notice for Patients and Hospital Staff: What Pensieve Does and Does Not Hold About You

DIS-GL-037 | Version 1.0.0 | Last Modified On 03 August 2026

---

You may have seen the name Pensieve on a discharge summary, a bill, a text message, or a screen at your hospital. If you searched for it and found this page, this is written for you. It uses plain words. You do not need to be a lawyer to read it. If anything here worries you, the last two sections tell you exactly who to contact.

#Who is Pensieve, and why is its name on my paperwork?

Pensieve is software that hospitals use to run their day-to-day work. It helps a hospital book appointments, keep records, prepare bills, manage the pharmacy, and organise the wards. It is made by a company called Pensieve Labs.

Your hospital chose to use Pensieve. That is why the name appears on paperwork the hospital gives you. We are not your hospital, and we are not your doctor.

#Who is in charge of my records, the hospital or Pensieve?

Your hospital. This is the most important point on this page.

Your hospital decides what goes into your records, who can see them, and what happens to them. Under India's data-protection law, your hospital is the Data Fiduciary. That is the formal way of saying the hospital is in charge of your records and is the one responsible to you.

Pensieve is the Data Processor. That means we only handle your records when your hospital tells us to. We follow the hospital's instructions. We cannot use your records for our own reasons. Everything we are allowed to do is set out in a written contract with your hospital, the Data Processing Agreement (DPA-GL-001).

So if you have a question about your records, your hospital is the right place to ask. It holds them, and it can answer you.

#How do I get a copy of my records, fix a mistake, or ask for them to be removed?

Ask your hospital, not Pensieve. Because the hospital is in charge of your records, only the hospital can give you a copy, correct a mistake, or delete something.

Here is how to find the right route:

• Look for your hospital's own privacy notice. It usually names a person or a desk to contact.
• Or ask at the hospital's medical records department, or at the front desk.
• Or ask for the hospital's grievance officer or data protection contact.

Indian medical rules require your hospital to give you a copy of your records when you ask, normally within 72 hours.

If you contact Pensieve by mistake, we will not ignore you. We will tell you that the hospital holds your records, and, where you ask us to, we will pass your request on to the hospital. We will not make the decision ourselves, because it is not ours to make.

#What does Pensieve actually do with my records?

Only what your hospital tells us to. In plain terms, we keep the hospital's records running safely, so that staff can find them when they need them.

When your hospital asks us to hand records back to it, or to delete them, we do that, and we give the hospital proof that it was done. The exact steps and timeframes are set out in DIS-GL-023.

#What does Pensieve never do?

This is a short list you can keep in your head. Pensieve never:

• sells your records, to anyone, for any price;
• uses your records to show you advertising;
• gives your records to another hospital, or to a stranger;
• makes a decision about your medical care; or
• contacts you directly for its own reasons.

These are firm commitments, not preferences.

#Does a computer or AI decide anything about my health?

No. No computer at Pensieve decides your diagnosis, your treatment, or your care. Those decisions are made by your doctors and nurses. Pensieve is not a medical device, and it is built so that it cannot cross that line. The full explanation is in DIS-GL-028.

Where Pensieve uses automated tools, they are for office tasks, such as suggesting billing codes or predicting how much stock a pharmacy needs. A person stays in charge. What these tools do, and what they are not allowed to do, is described in DIS-GL-027.

We also do not use your records to train or teach any AI system. That commitment has no exceptions.

#Are my records kept safe?

We protect records with measures such as encryption, which scrambles data so that it cannot be read by anyone who is not allowed to see it. How this works is described in DIS-GL-011.

No honest company can promise that a security problem will never happen. What we can tell you is what we do to prevent one, and what we do if one occurs.

#Where are my records kept?

By default, your hospital's records are stored on computers located in India. Some hospitals choose a different setup, and then the hospital decides where its records sit. The full detail, for each type of setup, is in DIS-GL-008.

#What happens if there is a data breach?

If your records are ever caught up in a security incident, your hospital is the party that must tell you what happened and what you can do about it. That is the hospital's duty, because it is in charge of your records.

Our job is to warn the hospital straight away, so that it can act quickly. What we promise the hospital, and how fast, is in DIS-GL-016. The kind of notice a hospital sends to a person whose data is affected is shown in NTC-GL-003.

#Does Pensieve ever hold information about me in its own right?

Sometimes, but never your medical records. There are a few narrow cases where Pensieve holds information about a person for its own purposes:

• if you visit our website, https://pensievelabs.org; or
• if you are a member of hospital staff and you have your own Pensieve login.

In those cases, and only those, Pensieve is in charge of that limited information. How we handle it, and your rights over it, are set out in our Privacy Policy (POL-GL-053). Your medical records are never covered by that policy. They belong to your hospital.

#What if the hospital route does not work, or I want to raise it with Pensieve anyway?

You can always come to us. If you have tried your hospital and are not satisfied, or you simply want to raise a concern with Pensieve Labs directly, write to our Grievance Officer.

We will reply. If your concern is really about your hospital's records, we will tell you so and, where you ask, pass it to the hospital. How we handle complaints, and how long we take, is set out in our Grievance Redressal Policy (POL-GL-066).

#Can I take it further?

Yes. You can raise a data-protection concern with the Data Protection Board of India. This is the government body set up under the Digital Personal Data Protection Act, 2023 to oversee how organisations handle personal data. This law is being brought into force in stages, so parts of this route are still being set up. Your hospital's duty to give you a copy of your records applies now.

You do not have to go through Pensieve first before you contact the Board.

#A note for hospital staff

If you work at a hospital and use Pensieve, two things are true at once. Inside your hospital's records, your information belongs to the hospital, in the same way a patient's does. But your Pensieve login, and the record of how you use it, are held by Pensieve Labs in its own right, and our Privacy Policy (POL-GL-053) covers that. If you have a question about either, the contacts above apply.

---

#Related documents

---

#Change history

---

DIS-GL-037 v1.0.0 | Last Modified On 03 August 2026 | Review due 03 February 2027 | Published at https://trust.pensievelabs.org