#Support Policy and Escalation Matrix

Confusing these three costs a hospital hours in an incident. They are separate on purpose.

1.1 The Support Center is the channel; the SLA is the commitment. Pensieve does not restate the Support Center's contents in the Trust Center, and does not restate the SLA's commitments in the Support Center. Where a Support Center article appears to promise something different from SLA-GL-001, SLA-GL-001 governs and Pensieve corrects the article. This mirrors SLA-GL-001 clause 12.1.

1.2 No support commitment is made anywhere except in SLA-GL-001. Statements made in a sales conversation, a demonstration, a proposal deck or a Support Center article do not create a support obligation.

2.1 Wrong-door rule. A request that arrives in the wrong channel is routed, not rejected. Pensieve re-routes it, tells the sender where it went, and, where a statutory clock applies, as it does for a Data Principal request under POL-GL-066, starts that clock from the original arrival, not from the re-routing. Nobody loses a day because they used the wrong address.

2.2 The eight-contact limit is a support construct, not an access construct. The limit on Authorised Support Contacts in SLA-GL-001 clause 12.6 governs who may escalate. It is unrelated to the Trust Center credential limit in POL-GL-500 and unrelated to the number of hospital users of the Platform, which is not capped.

Pensieve publishes this because a Ticket that contains these things is materially more likely to be fixed on first contact, and the hospital's own clock is the one that benefits.

3.1 A Ticket should carry: the hospital and site; the affected department and workflow; what was expected and what happened; the exact time it started; whether it affects one user, one department or everybody; the identifier of one affected record (never its clinical content); whether a workaround exists; and what changed recently on the hospital's side, if anything.

3.2 Never put patient data in a Ticket. Use record identifiers. Pensieve support personnel can retrieve the record through the audited access path in DIS-GL-033; they should not receive clinical content by e-mail. A Ticket found to contain patient data is redacted and the sender told.

3.3 Severity is claimed by the Customer and confirmed by Pensieve. The Customer states the Severity it believes applies. Pensieve works the Ticket at the claimed Severity until it is agreed otherwise, and never downgrades a Severity 1 without telling an Authorised Support Contact and recording the reason. The catalogue of what counts as which Severity is SLA-GL-001 Schedule B.

3.4 The Severity 1 telephone line is for Severity 1. Using it for anything else is not a breach of anything, but it does not accelerate the other Ticket, and it degrades the line for the hospital that needs it next.

4.1 What escalation does. Escalation adds seniority and decision-making authority to a Ticket. It does not add engineers Pensieve does not have, and Pensieve will not pretend otherwise (see 10). What it does add is a named person who can authorise an out-of-cycle release, a rollback, a restore from backup, a break-glass access under POL-GL-134, an on-site visit, or a commercial decision.

4.2 The ladder.

The named holder of each level for a given hospital, with direct telephone numbers, is SLA-GL-001 Schedule C.2. The times in the "engaged automatically" column are reproduced from that Schedule; where they differ, the Schedule governs.

4.3 Escalation is a right, not a favour. An Authorised Support Contact may escalate to any level at any time by saying so, in the Ticket or by telephone. No justification is required and none will be asked for. Pensieve records the escalation in the Ticket, states who now owns it, and gives a next-update time.

4.4 Automatic escalation happens without the Customer asking. The Support Center applies the times in 4.2 mechanically. A hospital should never have to chase a Severity 1 to make it move; if it does, that is itself a defect in Pensieve's process and is reportable under 11.

4.5 Update cadence during an escalated Ticket. While a Severity 1 is open, Pensieve gives an update every 60 minutes to the Authorised Support Contacts and posts to the status page where the cause is shared across hospitals. For a Severity 2 the cadence is every business day. An update that says "no change, still investigating, next update at HH:MM" is a valid update; silence is not.

4.6 Escalating in the other direction. Pensieve escalates to the hospital when a Ticket is blocked on the hospital: an unavailable contact, an unapproved change window, a third-party credential that has expired. The hospital's escalation ladder is SLA-GL-001 Schedule C.4. A Ticket blocked on the hospital is placed in a Customer Action Pending state, and the SLA clock is paused in accordance with SLA-GL-001 clause 7, with the pause recorded and visible in the Ticket.

5.1 A grievance is not a Ticket and a Ticket is not a grievance. A hospital that raises a service problem as a grievance under POL-GL-066 will be answered, but it will be answered more slowly than the same problem raised as a Ticket, because the grievance process is designed for a different purpose. This is stated so that nobody chooses the slower route by accident.

6.1 The list of work that is chargeable rather than included: new build, bulk data work, restoration of data a hospital user deleted, work caused by unnotified changes, re-integration after a third party changes its interface, additional training cohorts, on-site attendance, unsupported browsers, is SLA-GL-001 clause 12.4. It is not restated here and it does not change.

6.2 The two-hour rule. Where a problem appears to originate on the hospital's side of the Platform Boundary, Pensieve spends up to two hours per Incident helping to isolate it, free, before anything becomes chargeable (SLA-GL-001 clause 12.3). Pensieve does not spend that time arguing about whose problem it is.

6.3 Third-party systems. Pensieve supports the Platform's side of every integration. It does not support the third party's system, and it holds no credentials of its own for ABDM, NHCX, payment gateways, insurers or laboratories; those are the hospital's, supplied under ADD-GL-007 and used on the hospital's own authority. Responsibility is allocated in DIS-GL-026 for ABDM and NHCX and in ADD-GL-007 for everything else. Pensieve will still take the Ticket, still diagnose it, and still tell the hospital exactly what to say to the third party.

A prospective hospital is not left to wait for a sales cycle to answer a technical question.

7.1 Security, privacy, architecture and compliance questions are answered from the Trust Center. The majority are already answered in a published document; the questionnaire master answers are QRE-GL-008.

7.2 A question the Trust Center does not answer is answered by e-mail within two business days, or, where the answer requires work, with a date by which it will be answered.

7.3 During a pilot under ADD-GL-013, support is provided as recorded in that agreement. A pilot does not carry Service Credits.

7.4 Nothing in this clause is a commitment capable of being relied upon commercially; it is a statement of how Pensieve operates.

8.1 For the period after go-live recorded on the Order Form, Pensieve operates hypercare: a raised support posture with a named engineer, a daily check-in, and shortened internal escalation triggers. Hypercare is operated under RBK-GL-015 and exits against CRT-GL-008.

8.2 Hypercare does not change the contractual Severity definitions, response targets or Service Credits in SLA-GL-001. It changes Pensieve's internal posture, not the hospital's entitlement. Saying otherwise would be a promise that quietly expires.

For DM-1 and DM-2 this Policy applies without variation.

Pensieve is a small team. A hospital is entitled to know what that means before it depends on the Platform.

10.1 Pensieve does not offer a support tier it cannot staff. Where a hospital requires a staffed desk or a named dedicated engineer, that is a priced item on the Order Form and is only offered where Pensieve can actually deliver it.

Each statement below is auditable. Evidence is available to a Customer under DPA-GL-001 clause 15 and to an assessor under ADD-GL-001 clause 15.

11.1 Failure of T-2 or T-4 is treated as an internal incident, logged in REG-GL-203, because a hospital finding out for itself that escalation did not fire is the worst way to discover it.

12.1 This Policy is reviewed annually and on any material change to SLA-GL-001, under POL-GL-502.

12.2 A change that reduces what a hospital gets, such as removing a channel, lengthening an escalation trigger, narrowing who may escalate, takes effect 60 days after notice to Customers. A change that adds or clarifies takes effect on publication.

12.3 This Policy never varies SLA-GL-001. A commitment appears in SLA-GL-001 or it does not exist.