1.1 Edsol Edtech Pvt. Ltd. is a Private Limited Company incorporated in India, bearing Corporate Identity Number [TO BE SUPPLIED], with its registered office at 28, Jamunather Bulandshahar Uttar Pradesh India. It trades as Pensieve Labs and operates the Pensieve platform.

1.2 Contact points.

1.3 Where a representative is shown as [TO BE SUPPLIED], none has yet been appointed and Pensieve says so rather than implying one exists. Contact info@pensievelabs.org directly.

2.1 Pensieve as Data Processor. For all personal data inside a hospital's tenant, patient records, clinical documentation, diagnostic results, images, billing records, the hospital's own personnel records and the audit logs of its operations, the hospital is the Data Fiduciary and Pensieve is a Data Processor acting on the hospital's documented instructions. Pensieve does not determine the purposes of that processing, does not use it for its own purposes, and does not decide what is collected or how long it is kept. Section 8(1) of the Digital Personal Data Protection Act, 2023 places responsibility for that processing on the Data Fiduciary. The full terms are in DPA-GL-001.

2.2 Pensieve as Data Fiduciary. Pensieve is a Data Fiduciary for exactly two categories, neither of which is data inside a hospital's tenant:

2.3 What we never do. Pensieve does not: use hospital tenant data for its own purposes; sell, rent, licence or trade personal data; use personal data for behavioural advertising; build a cross-hospital profile of an individual; or use any customer data to train, fine-tune, validate or evaluate a machine-learning model. That last commitment is unconditional and is repeated in POL-GL-050 clause 7.3 and DPA-GL-001.

2.4 De-identified statistics. Where Pensieve derives operational statistics, aggregation and de-identification occur inside the tenant boundary before the data leaves it, no re-identification key is retained, and no output permits identification of an individual, a clinician or a hospital. Personal data under the Digital Personal Data Protection Act, 2023 is data about an identifiable individual; genuinely de-identified aggregates fall outside it. The constraints are in DPA-GL-001 clause 3.4.

3.1 An itemised description. The following is the itemised description of personal data required by Rule 3(b)(i) of the Digital Personal Data Protection Rules, 2025, with the purpose for each, required by Rule 3(b)(ii).

3.2 Support artefacts are the practical risk, and how it is closed. A support ticket, a screenshot or a log excerpt can inadvertently contain patient data. Pensieve's position is that it does not want to receive it. Product telemetry and application logs are redacted of personal data by default; support personnel are instructed not to request or retain patient data in a ticket; and where such data nevertheless reaches a ticket, it is treated as Customer Personal Data under DPA-GL-001, not as data Pensieve holds as a Data Fiduciary, and is removed. See DPA-GL-001 clause 3.5.

3.3 Data we do not want. Do not send us patient records, clinical documents or any individual's health data through a website form, a general email address or a support ticket. POL-GL-051 clause 6.2 says the same thing. Where a secure exchange is genuinely needed, ask and we will provide one.

3.4 Sources other than you. Where we obtain your business contact details from a public register, an industry directory, a conference list, a referral or a colleague at your organisation, we say so on first contact and tell you how to stop hearing from us.

4.1 India. Under the Digital Personal Data Protection Act, 2023, personal data may be processed for a lawful purpose either with the Data Principal's consent or for a certain legitimate use under section 7. Pensieve relies on:

4.2 European Union, European Economic Area and the United Kingdom. Where the General Data Protection Regulation applies, our bases are Article 6(1)(b) (performance of a contract or steps before entering one), Article 6(1)(c) (legal obligation), Article 6(1)(f) (legitimate interests: operating, securing and developing our business, where those interests are not overridden by your rights) and Article 6(1)(a) (consent, for marketing and for non-essential cookies). See Annexure A.

4.3 Australia. See Annexure B. United Arab Emirates. See Annexure C.

4.4 Withdrawing consent. Where we rely on consent, you may withdraw it at any time by writing to info@pensievelabs.org or by using the unsubscribe link in any marketing message. Withdrawal is as easy as giving consent was. Withdrawal does not affect processing already carried out, and does not affect processing we carry out on a different basis; for example, we will continue to hold contract and invoice records that tax law requires us to keep.

Rule 3 of the Digital Personal Data Protection Rules, 2025 requires a notice to be understandable independently of any other information, to give an itemised description of the personal data and the purposes in clear and plain language, and to give the means to withdraw consent, to exercise rights and to complain to the Data Protection Board. This Policy meets those requirements as follows.

A note on timing, stated honestly. Sections 3 to 17 of the Digital Personal Data Protection Act, 2023, and Rules 3 and 5 to 16 of the Digital Personal Data Protection Rules, 2025, commence on 14 May 2027. Pensieve operates to that end state now rather than waiting for the commencement date. The Data Protection Board of India was constituted in the first tranche of commencement; where a step in this Policy depends on the Board being operational, this Policy says so.

6.1 The rights. In respect of personal data Pensieve holds as a Data Fiduciary, you have the following rights under the Digital Personal Data Protection Act, 2023. Equivalent and additional rights under other laws are in the Annexures.

6.2 How to make a request. Write to info@pensievelabs.org, or use the rights request form published at https://trust.pensievelabs.org/privacy/request. Requests are accepted in English or Hindi.

6.3 The identifier we need. Rule 14(5) of the Digital Personal Data Protection Rules, 2025 requires a Data Fiduciary to publish the identifier by which a request is made. Ours is the work email address you gave us, or, where you hold a Pensieve credential, that credential's registered email address. Where you write from a different address we will ask you to verify control of the registered address; we do this to protect you, and we will not ask for a government identity document to process a routine request.

6.4 Our timelines.

6.5 No charge. We make no charge for a rights request. Where a request is manifestly unfounded or repetitive we may say so and decline it, with reasons and with the escalation route in 6.8.

6.6 What we will tell you when we refuse. Where we refuse a request in whole or in part we will tell you which part, the reason, the provision relied on, and how to escalate. We will not refuse silently.

6.7 Erasure against a retention obligation. Where you ask us to erase data we are required to keep, we will erase what we can, retain what we must, and tell you exactly which records were retained and under which obligation. That record is an Erasure Decision Record and you may have a copy.

6.8 Escalation. If you are not satisfied with our response:

6.8.1 escalate within Pensieve under the Grievance Redressal Policy (POL-GL-066), which names the escalation ladder and the response times at each rung;

6.8.2 India: complain to the Data Protection Board of India, once it is operational, by the means the Board publishes. Pensieve will not require you to exhaust its internal process before you approach the Board, although the Act contemplates that you do;

6.8.3 European Union / European Economic Area: complain to the supervisory authority of your habitual residence, place of work or the place of the alleged infringement, including Datatilsynet in Denmark and Datatilsynet in Norway;

6.8.4 Australia: complain to the Office of the Australian Information Commissioner; and

6.8.5 United Arab Emirates: complain to the UAE Data Office, or to the applicable free-zone authority where the free-zone regime applies.

6.9 Data Principals of a hospital. If you are a patient or another individual whose record a hospital holds, your rights run against the hospital, not against Pensieve. Where you contact us, we will tell you so, route your contact to the hospital where you ask us to, and take no decision on the merits. Pensieve's contact details are not published to patients as a route for exercising rights, because doing so would misdirect them.

7.1 The principle. We keep personal data for as long as the purpose it was collected for is being served, and then for as long as a law requires, and then we delete it.

7.2 Retention periods.

7.3 Log retention floor. The minimum log-retention figures above reflect a deliberate choice to take the longest applicable floor rather than track several: Rule 6(1)(e) and Rule 8(3) of the Digital Personal Data Protection Rules, 2025 each set a one-year minimum, and Direction (iv) of the CERT-In Directions of 2022 requires 180 days of ICT system logs held within Indian jurisdiction. The applied configuration is stated in DIS-GL-034.

7.4 Legal hold. Where data is relevant to an actual or anticipated legal proceeding, an investigation or a regulatory request, we suspend deletion for as long as necessary and record the reason.

7.5 Deletion. On expiry, records are deleted from production systems and then from backups within the backup rotation period stated in DIS-GL-023.

8.1 We do not sell personal data. We have never sold, rented, licensed or traded personal data, and we do not do so.

8.2 Service providers. We share personal data with the service providers that operate our own systems. The current list, with each provider's role, the data it touches and the country of processing, is the Subprocessor Register (DIS-GL-009), which is published, dated and maintained. The register is the single source of truth; this Policy does not restate it, because a list restated in two places goes stale in one of them.

8.3 Changes to service providers. Changes are notified through the Sub-Processor Change Log (DIS-GL-010) and the notification and objection terms in POL-GL-055.

8.4 Other recipients. We may also disclose personal data to: our professional advisers under a duty of confidence; an insurer where a claim arises; a bank or payment processor to receive payment; a regulator, court or public authority where legally required, under POL-GL-067; and an acquirer or successor of our business, under the same protections as this Policy, with notice.

8.5 Hospitals. Where you hold a credential issued at a hospital's request, we tell that hospital about your credential, your access rights and your access activity. That is the point of the credential and the audit trail, and the hospital is entitled to it.

8.6 Aggregate reporting. We publish aggregate figures, for example in the Transparency Report (POL-GL-068), that contain no personal data.

9.1 The default. Pensieve's default position is that customer personal data and system logs are stored and processed in India, in the Google Cloud India regions, with regional rather than global log storage. The full residency position, per deployment model and per market, is the Data Residency Statement (DIS-GL-008).

9.2 Data covered by this Policy. Business contact data and service operations data covered by this Policy are held in the systems listed in DIS-GL-009. Some of those systems process data outside India. The register states which, and where.

9.3 India: the legal position. Section 16(1) of the Digital Personal Data Protection Act, 2023 allows the Central Government to restrict transfer to a notified country. This is a negative-list model: transfer is lawful unless the destination is notified. As at the Last Modified On date of this Policy, no country has been notified. Rule 15 adds a condition directed at making personal data available to a foreign State or to a person or entity under its control, not at commercial cloud vendors. Section 16(2) preserves stricter sectoral rules, and health-sector localisation expectations and the CERT-In log localisation requirement are the constraints that actually bind, which is why the default at 9.1 is India.

9.4 If a country is notified. If the Central Government notifies a restricted country, Pensieve will comply and will move or cease the affected processing. That commitment is contractual in DPA-GL-001 clause 12.

9.5 Transfers out of the EU and EEA. Where the General Data Protection Regulation applies and personal data is transferred to India, there is no adequacy decision for India. Transfers are made on the European Commission's Standard Contractual Clauses with a transfer impact assessment. See Annexure A.

9.6 Government access. Pensieve's position on demands from public authorities, including the process it follows and the honest limits of that process, is in the Legal & Law Enforcement Request Policy (POL-GL-067) and DPA-GL-001 clause 17. Pensieve grants no public authority direct, standing or back-door access to any system, and has created no mechanism by which such access could be given.

10.1 We do not knowingly process children's data as a Data Fiduciary. The Platform is a business system. A Pensieve credential is not issued to a person under the age of eighteen (18) years, our website and Trust Center are directed at organisations, and we do not knowingly collect personal data of a child in our own capacity.

10.2 If we learn that we have. If we discover that we hold a child's personal data as a Data Fiduciary, we delete it, unless a law requires us to keep it, and we record the decision.

10.3 No tracking or profiling of children. Section 9(3) of the Digital Personal Data Protection Act, 2023 prohibits tracking, behavioural monitoring and targeted advertising directed at children. Pensieve does none of those things for anyone, of any age, in any capacity: there is no behavioural advertising in any Pensieve property and no third-party tracker in the Trust Center (POL-GL-052 clause 8.2).

10.4 Children's data inside a hospital's tenant. Paediatric records inside a hospital's tenant are the hospital's, and the hospital is the Data Fiduciary. Rule 12 read with Part A of the Fourth Schedule to the Digital Personal Data Protection Rules, 2025 exempts a clinical establishment, a mental health establishment, a healthcare professional and an allied healthcare professional from section 9(1) and section 9(3) where the processing is restricted to the provision of health services to the child, to the extent necessary for the protection of her health. Section 9(2), no processing likely to have a detrimental effect on a child's well-being, is not exempted and continues to apply.

10.5 The product boundary that follows from that. The exemption is conditional on necessity for health protection. Marketing, campaign, loyalty and engagement use of paediatric data falls outside it. The Platform therefore prevents a marketing, campaign or outreach selection from including records flagged as belonging to a person under 18. This is a hard product boundary, not a configuration option, and it is stated so that a hospital can rely on it. See DPA-GL-001 clause 9.8.

10.6 Guardianship. Rule 11 makes equivalent provision for a person with a disability who has a lawful guardian. The Platform supports the recording of a guardian and a nominee; the verification of guardianship is the hospital's.

11.1 What we implement. The controls Pensieve applies are stated in the Security Addendum (ADD-GL-001) and in the disclosures it references: encryption (DIS-GL-011), authentication and access control (DIS-GL-012), audit logging (DIS-GL-013), backup and recovery (DIS-GL-014), vulnerability management (DIS-GL-017) and personnel security (DIS-GL-020). They are not restated here.

11.2 The statutory minimum, met item by item. Rule 6(1) of the Digital Personal Data Protection Rules, 2025 sets a closed list of seven minimum safeguards. Pensieve publishes a clause-by-clause mapping of that list to implemented controls, with evidence. It is the shortest honest answer to "is this vendor secure enough under Indian law".

11.3 No absolute claim, and no certification. Pensieve does not represent that its systems are immune from compromise, and holds no certification of its information security management system. It states what is implemented, publishes the evidence and the gaps, and commits to defined notification timelines.

11.4 If there is a breach. Where a personal data breach affects data Pensieve holds as a Data Fiduciary, Pensieve will notify each affected individual without delay, with the description, likely consequences, mitigation taken, the safety measures you may take, and a contact who can answer your questions; and will notify the Data Protection Board without delay and in detail within 72 hours of becoming aware, in each case as Rule 7 of the Digital Personal Data Protection Rules, 2025 requires. Where a breach is a reportable cyber incident, Pensieve reports it to CERT-In within 6 hours of noticing it, under Direction (ii) of the CERT-In Directions of 2022. The commitments and the three-clock model are in DIS-GL-016. Where the breach affects a hospital's tenant data, DPA-GL-001 clause 10 governs and Pensieve notifies the hospital, not the Data Principal.

Cookies, local storage and similar technologies are described in the Cookie Policy & Consent Notice (POL-GL-054), which names every cookie set on each Pensieve property, its purpose, its duration and whether it is strictly necessary. That policy also records that the Trust Center uses no third-party analytics, advertising or tracking technology at all. This Policy does not restate it.

13.1 No automated decision with legal or similar effect. Pensieve does not make a decision about you, as a Data Fiduciary, based solely on automated processing that produces a legal effect or similarly significantly affects you. A Trust Center access request is decided by a person, except where the hospital has asked us to configure automatic approval for a verified domain, which grants access rather than refusing it.

13.2 AI in the Platform. Where an artificial-intelligence capability is made available in the Platform, what it does, what it does not do, what data it processes, the human oversight applied and how to turn it off are disclosed in DIS-GL-027 and governed by ADD-GL-006 and POL-GL-060. No such capability produces a clinical decision.

13.3 No training on customer data. Restated because it is the question most often asked: Pensieve does not use customer data, including any hospital's tenant data and including the personal data covered by this Policy, to train, fine-tune, validate or evaluate any machine-learning model. Using patient data to develop or validate a model would also be biomedical research under the Indian Council of Medical Research's ethical guidelines of 2023, requiring institutional ethics committee review. Pensieve does not do it.

Pensieve's process on receiving a demand from a court, a regulator or a law-enforcement authority (legality review, challenge where there is a basis, minimum necessary disclosure, notice to the affected customer where lawful, and the record kept) is the Legal & Law Enforcement Request Policy (POL-GL-067). The aggregate numbers are published in the Transparency Report (POL-GL-068). Neither is restated here.

15.1 We may change this Policy. Every version carries a version number, an effective date and a Last Modified On date, and superseded versions remain retrievable at https://trust.pensievelabs.org.

15.2 Where a change materially affects how we process personal data about you, we will notify you by email to the address we hold, at least thirty (30) days before it takes effect, and will tell you what changed. A clarifying change takes effect on publication and is recorded in the change history.

15.3 We will not use a change to this Policy to begin processing on a basis you have not been told about, or to reduce a commitment at 2.3.