#Privacy Policy: GDPR Variant

POL-EU-053 v1.0.0, Last Modified On 01 August 2026, Tier: Public

---

#Read this first: the one thing that decides whether this policy applies to you

If you are a patient of a hospital that uses Pensieve, this policy does not govern your health records. Your hospital does.

The hospital is the controller of its patients' personal data. It decides what is recorded, who may see it, how long it is kept and on what legal basis it is processed. Edsol Edtech Pvt. Ltd. is the processor: it operates the platform on the hospital's documented instructions and does nothing with patient data on its own account. A patient exercising a right under the GDPR should contact the hospital, which will contact Pensieve Labs if it needs assistance. If a patient contacts Pensieve Labs directly, Pensieve Labs will not answer the substance; it will pass the request to the hospital within two business days, tell the patient it has done so, and identify the hospital if the patient does not already know it.

This policy covers the personal data Edsol Edtech Pvt. Ltd. processes as a controller in its own right: the personal data of people who visit its websites and Trust Center, who contact it, who work at a customer or prospective customer and deal with it, who apply for a role, and who report a security vulnerability.

---

#1. What this varies

This is the EU/EEA fork of the global privacy policy POL-GL-053, which is written to Indian statutory notice requirements. The two are not cumulative: if you are in the EEA, this policy applies to you and POL-GL-053 does not. The substantive processing is the same; the information duties, the legal bases and the rights are stated here as Articles 13, 14 and Chapter III of the GDPR require.

---

#2. Who we are

---

#3. What we process, why, and on what legal basis

Each row states the categories, the purpose, the Article 6 basis, the source if not you, and the retention. Where the basis is legitimate interests, the interest is named; a legal basis that does not say what the interest is has not been given.

Special-category data. In its own controller processing Edsol Edtech Pvt. Ltd. does not seek, and asks you not to send, data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, health data, or data concerning sex life or sexual orientation. Where such data reaches us unsolicited (most commonly in a support ticket), we treat it under DPA-EU-001 if it is a customer's patient data, and otherwise delete it.

Children. Our sites and services are not directed to children and we do not knowingly collect children's personal data in our controller capacity. Where a hospital's deployment processes children's data, the hospital is the controller and the national conditions applicable to it govern.

---

#4. Legitimate interests: the balance, stated

Where we rely on Article 6(1)(f) we have carried out a balancing assessment. Its substance:

A copy of the full assessment for any row is available on request to info@pensievelabs.org. We publish the substance rather than asserting that a balance was struck.

---

#5. Who we share with

We do not sell personal data and we do not share it for another party's marketing.

---

#6. International transfers

Edsol Edtech Pvt. Ltd. is established in India, for which there is no adequacy decision under Article 45. We say so plainly rather than burying it.

REP-GL-021, our transfer impact assessment, concludes that Indian law does not, on its face, provide protection essentially equivalent to that guaranteed within the Union. It then explains, measure by measure, why a specific transfer is nonetheless lawful, and what would suspend it. We publish it because a vendor willing to write that down is a vendor whose other statements can be believed. A copy of the Clauses and of the assessment is available on request.

DIS-EU-008 states where data is stored and how the plaintext boundary works.

---

#7. Your rights

Under Chapter III of the GDPR you have the right to:

How to exercise. Email info@pensievelabs.org. We respond without undue delay and in any event within one month, extendable by two further months for complex or numerous requests, in which case we tell you within the first month and explain why. There is no charge unless a request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse and explain why.

Verification. We verify identity proportionately. We do not demand an identity document where an existing account or a reply from a known address is sufficient, and we do not use verification as a delay tactic.

If you are a patient, see the box at the top: the hospital is the controller and your rights are exercised against it. We assist the hospital within seven business days.

---

#8. Automated decision-making and profiling

Edsol Edtech Pvt. Ltd. does not make decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. Trust Center access requests may be routed by a domain rule, but a refusal is reviewed by a person before it takes effect, and you can ask for that review.

Inside the Platform, any automated processing is the hospital's, configured by the hospital, and is disclosed in DIS-GL-027. Pensieve Labs does not use customer data to train a model that serves another customer.

---

#9. Complaints

If you think we have processed your personal data unlawfully, please tell us first at info@pensievelabs.org. We would rather fix it than be told about it by a regulator. You are entitled to complain regardless, to the supervisory authority of the EEA State in which you live, work, or where the alleged infringement took place. In Denmark that authority is Datatilsynet; in Norway it is Datatilsynet. You also have the right to an effective judicial remedy under Article 79 and to compensation under Article 82.

---

#10. Cookies and similar technologies

POL-GL-054 is the cookie policy and it is the source of truth. In summary, on our EEA-facing properties:

• Strictly necessary cookies are set without consent, as the ePrivacy rules permit.
• Every other category (analytics, preference, any measurement not strictly necessary) is set only after opt-in consent, obtained through a banner that offers "reject all" as prominently as "accept all", with no pre-ticked boxes, no legitimate-interest tab for non-necessary purposes and no cookie wall.
• Consent can be withdrawn as easily as it was given, from the same control.
• We do not use advertising or cross-site tracking cookies on the Trust Center.

---

#11. Security

We describe our security controls publicly rather than asserting that data is "secure": WPR-GL-001, DIS-GL-011 (encryption), DIS-GL-012 (access control), DIS-GL-013 (audit logging) and DIS-GL-017 (vulnerability management). Edsol Edtech Pvt. Ltd. holds no security certification of any kind; WPR-GL-005 says what compensates for that and what a hospital should verify instead.

If a personal data breach affecting you occurs and it is likely to result in a high risk to your rights and freedoms, we will communicate it to you without undue delay under Article 34, unless one of the Article 34(3) exceptions applies. DIS-EU-016 states the commitments in full.

---

#12. Changes to this policy

We version this policy, date it, and keep the previous versions retrievable at https://trust.pensievelabs.org. Where a change materially affects how we process your personal data we notify you before it takes effect, by email where we have your address, and by a notice on the site otherwise. We do not make a material change effective retrospectively.

---

#13. Related documents

---

#14. Change history