1.1 Five tiers. Every document in the Trust Center carries one access tier. The tier is shown on the document and on its library listing.

1.2 The bias. Pensieve publishes at the Public tier by default. A higher tier must be justified, not assumed. The tiering doctrine and the criteria for each tier are in the Document Classification & Publication Policy (POL-GL-501).

1.3 A tier is not a promise of content. Pensieve does not undertake to publish any particular document at any particular tier, and may reclassify a document. Reclassification does not affect a copy you have already lawfully obtained, but the conditions in 5 continue to apply to that copy.

2.1 The flow. A visitor submits the Request Access Form (FRM-GL-504) with a work email address, the organisation they represent and the reason for the request. A Pensieve administrator reviews it and either approves it, which provisions a credential and sends the approval notice (NTC-GL-505), or declines it, with the denial notice (NTC-GL-506). Domain-based automatic approval may be configured for a hospital whose deal is already in progress.

2.2 Discretion. Access is granted at Pensieve's discretion. Pensieve may decline a request without giving a reason, and may decline a request from a personal email address, from an anonymised domain, from a competitor, or where the request is inconsistent with the stated purpose. Declining a request is not a statement about the requester.

2.3 What a credential is. A credential is issued to a named individual at a work email address, for that individual's use in the course of their role. It is not issued to a team, a role account, a shared mailbox or an organisation.

2.4 The five-credential limit. A hospital workspace holds a maximum of five (5) active client credentials at any time. This limit is enforced by the system, not by policy. Where a sixth is needed, the hospital deactivates one or submits the Additional Credential Request Form (FRM-GL-509); Pensieve considers it and may grant a time-limited increase, recording the reason. The limit-reached notice is NTC-GL-508.

The limit exists to keep the population of people holding a hospital's confidential contractual material small, known and attributable. It is not a commercial lever, and Pensieve does not charge for additional credentials.

2.5 Duration and review. A credential remains active while the relationship it was granted for is active. Pensieve reviews client credentials on the cadence in the Trust Center Access Policy (POL-GL-500) and deactivates those no longer needed. The hospital must notify Pensieve within one (1) Business Day when a credential holder leaves or changes role, and may deactivate a credential itself at any time.

2.6 Your obligations as a credential holder. You must: keep the credential to yourself; not share it, delegate it or allow another person to use it; use the authentication method provisioned, including multi-factor authentication where required; access only what your role needs; and report a suspected compromise to info@pensievelabs.org without delay.

3.1 NDA-accepted material is released only after acceptance of the click-through mutual non-disclosure agreement (NDA-GL-002). Acceptance is recorded as an evidentiary event: the accepting identity, the accepted version, the timestamp and the network address.

3.2 NDA-GL-002 governs the confidentiality of the material it releases. These Terms do not vary it, and where these Terms and NDA-GL-002 differ on the treatment of material released under it, NDA-GL-002 prevails.

3.3 Where you have executed the negotiated mutual non-disclosure agreement (NDA-GL-001), that agreement governs instead for the material within its scope.

4.1 Watermarking. Documents served at the NDA-accepted and Client tiers are watermarked per viewer at render time. The watermark carries the viewer's identity, the access-grant reference and the time of rendering, is applied on every page, and is baked into the file rather than overlaid by a viewer. The practice and its purpose are stated in the Watermarking & Leak-Tracing Notice (POL-GL-510).

4.2 Why it is disclosed. Pensieve tells you the document is watermarked, and what the watermark contains, before you download it. A covert watermark would be a poor way to run a trust centre.

4.3 Inline-only material. The most sensitive material may be served inline to a viewer with no download endpoint. Where that applies, the document says so.

4.4 Access logging. Every view, download, access grant, access change and acceptance event is recorded in an immutable audit log, retained under the Trust Center Audit Log Retention Policy (POL-GL-503). The log records who, what, when and from which network address.

4.5 Use of the log. Pensieve uses the log to operate and secure the Trust Center, to investigate a suspected unauthorised disclosure, to evidence what a party was given and when, and to respond to a lawful demand under POL-GL-067. A hospital may request the log of its own workspace at any time, at no charge.

4.6 Tracing a disclosure. Where a Pensieve document appears outside the population entitled to it, Pensieve may use the watermark and the log to establish the source. This is stated plainly so that no recipient is surprised by it.

5.1 Permitted use. You may use a document obtained from the Trust Center to:

5.1.1 evaluate whether to acquire, renew or extend the Platform;

5.1.2 conduct your organisation's security, privacy, clinical-governance, procurement, insurance or legal review;

5.1.3 brief your board, your committee, your accreditation assessor or your regulator;

5.1.4 obtain advice from your professional advisers (counsel, auditors, insurers, consultants) provided they are bound by a professional or contractual duty of confidence at least as protective as the tier the document was released at; and

5.1.5 negotiate, execute and administer an agreement with Pensieve.

5.2 Conditions on every copy. Whatever the tier:

5.2.1 do not remove, obscure, crop or alter a watermark, a version stamp, a Last Modified On date, a document identifier, an integrity hash or a classification marking;

5.2.2 do not present a document, or an extract of one, as saying something it does not say, or quote it out of the context that qualifies it;

5.2.3 do not represent that Pensieve holds a certification, an approval, an accreditation or a customer that the document does not state: Pensieve holds no formal certification, and no document in the Trust Center says otherwise; and

5.2.4 do not use a document to train a machine-learning model without our prior written consent.

5.3 Public-tier documents. A Public-tier document may be shared, quoted with attribution, and given to your advisers without restriction beyond 5.2. It is published so that it can be circulated.

5.4 Email-verified, NDA-accepted and Client documents. These may be shared only within the population in 5.1. They must not be published, posted, uploaded to a public or shared repository, given to a competitor of Pensieve, or given to any person outside that population without our prior written consent.

5.5 Another hospital's material. Nothing in the Trust Center gives access to another customer's identity, contracts, commercial terms or data. If material of that kind reaches you through an error, tell us at info@pensievelabs.org, do not read further, do not copy it, and delete it on our confirmation.

5.6 Templates are not executed agreements. A contract, addendum or form published in the Trust Center is a standard form. It is published so that it can be read before negotiation. It is not an offer, does not bind either party, and creates no obligation until it is executed by authorised signatories in accordance with its own execution provisions.

5.7 Return and deletion. On written request, or on the ending of your access, you must stop using NDA-accepted and Client material and return or delete the copies you hold, subject to your own retention obligations under law, professional rules or your document-retention policy, and subject to the retention of one archival copy where those rules require it. Retained copies remain subject to 5 and to NDA-GL-002.

6.1 Statements of fact, dated. A disclosure, register or statement in the Trust Center states what was true when it was published, at the version and Last Modified On date it carries. Practice changes. Documents carry a review date and Pensieve tracks staleness under POL-GL-502; where a document is overdue for review, the Trust Center shows its true age rather than concealing it.

6.2 Not a warranty. Except where a document is executed by Pensieve and expressly given as a warranty or an attestation, a Trust Center document is a disclosure, not a contractual warranty. Contractual warranties live in MSA-IN-001, DPA-GL-001, SLA-GL-001 and ADD-GL-001.

6.3 The current version governs, except where frozen. The Trust Center serves the current version of a template. Where a document has been issued, signed or executed, that instance is frozen: its rendered content, its resolved values, its template version and its content hash are persisted and cannot be altered by a later change. A later change to a published standard form does not alter an agreement already executed on an earlier version.

6.4 Verification. A legal-variant document carries a document integrity hash and a verification link resolving to https://trust.pensievelabs.org/verify/. Anyone holding a copy may check that it matches what Pensieve published or executed.

6.5 No advice. Trust Center documents are not legal, regulatory, tax, clinical or professional advice. Where a document describes a law, a rule or a deadline, it describes Pensieve's reading of it at the date stated. Take your own advice.

6.6 Candour markings. Pensieve marks unverified points [UNVERIFIED] and estimates [ESTIMATE] in its own material, and states limitations where a control does not exist. Those markings are the point, not a defect. Do not read an absence of them as an assurance.

7.1 Prohibited conduct. You must not attempt to gain unauthorised access to the Trust Center, to another workspace, to another user's account, or to any document above your tier; must not probe, scan or test its security other than under 7.2; must not introduce malicious code; must not use an automated system to enumerate documents, accounts or workspaces; and must not scrape the Trust Center at a rate or volume that degrades it.

7.2 Vulnerability reporting. A suspected vulnerability in the Trust Center is reported under the Vulnerability Disclosure Policy (POL-GL-059) to info@pensievelabs.org. Pensieve does not pursue a good-faith researcher who complies with that policy, and treats a report as a contribution.

7.3 Availability. The Trust Center is provided as available. No service level applies to it. Where it is unavailable and you need a document urgently, ask at info@pensievelabs.org and Pensieve will supply it by another route.

8.1 What Pensieve holds about you. Pensieve processes your name, work email address, organisation, role, the reason recorded on your access request, your access grants and your access log as a Data Fiduciary in its own right. The purposes, the lawful basis, the retention period and your rights are in the Privacy Policy (POL-GL-053).

8.2 No third-party analytics or trackers. The Trust Center uses no third-party analytics, no advertising technology, no session-replay tool, no marketing pixel and no cross-site tracker. It sets only the cookies strictly necessary to authenticate a session and to protect against forgery. This is a deliberate design decision: a property whose purpose is to be trusted with a hospital's security paperwork should not be instrumented by third parties. The Cookie Policy & Consent Notice (POL-GL-054) states exactly which cookies exist and what each does.

8.3 Consequence. Because there is no third-party tracking, Pensieve cannot tell you which of your colleagues read which page, and cannot sell or share that information, because it does not exist.

8.4 Grievances. A complaint about Pensieve's handling of your personal data is made under POL-GL-066 to info@pensievelabs.org.

9.1 Grounds. Pensieve may suspend or withdraw access, immediately and without prior notice where necessary, for: a breach of 2.6, 5 or 7.1; a suspected compromise of a credential; a credential holder ceasing to be entitled; the ending of the relationship the access was granted for; or a requirement of Applicable Law.

9.2 Notice. Pensieve notifies the affected individual and the hospital's primary contact using the Access Revoked Notice (NTC-GL-507), stating the ground.

9.3 Effect. 5.7 applies on withdrawal. Withdrawal of Trust Center access does not affect any executed agreement, and does not affect a Customer's right to export its data under WPR-GL-400, which operates independently of Trust Center access.

9.4 Reinstatement. Access may be reinstated once the ground is removed. A reinstatement request is made to info@pensievelabs.org.

10.1 Trust Center documents are Pensieve's copyright material, except for third-party material used with permission. 5 states the licence granted, and no other right is granted.

10.2 Pensieve Labs, Pensieve and the associated marks are ours; permitted use is in POL-GL-062.

10.3 Where a Trust Center document is provided in a machine-readable format, such as a subprocessor feed, a software bill of materials, a questionnaire response set, it is provided so that you can consume it in your own tooling. That is a permitted use.

11.1 As is. To the fullest extent Applicable Law permits, the Trust Center is provided as is and as available, and all warranties, conditions and representations, express or implied, are excluded. This does not affect a warranty or attestation given in an executed document.

11.2 Liability. To the fullest extent Applicable Law permits, Pensieve is not liable for loss arising from use of, or inability to use, the Trust Center, or from reliance on a document contrary to 6.5. Nothing excludes liability for death or personal injury caused by negligence, for fraud, or for any liability Applicable Law does not permit to be excluded. Where an executed agreement is in force, its liability regime governs claims within its scope.

11.3 Changes. Pensieve may change these Terms. The current version and its Last Modified On date are published here; superseded versions remain retrievable. A material and adverse change is notified to active credential holders by email at least thirty (30) days before it takes effect. Continued use after that date is acceptance.

11.4 Governing law and jurisdiction. These Terms are governed by the laws of India, and the courts at Legal jurisdiction have exclusive jurisdiction, save that Pensieve may apply for urgent interim relief in any court of competent jurisdiction and save that a mandatory local right of action is unaffected.

11.5 Contact.