1.1 Anyone. Specifically:

1.2 No standing requirement. You do not need a contract with Pensieve to raise a grievance, and Pensieve will not decline one on the ground that you are not a customer.

1.3 Anonymous grievances. Accepted and investigated. Pensieve cannot answer you, verify facts with you, or apply the safe-harbour protections at 8 to a person it cannot identify, and says so.

1.4 Raised on your behalf. A grievance may be raised by a representative, an advocate, a nominee under section 14 of the Digital Personal Data Protection Act, 2023, or a lawful guardian. Pensieve will ask for evidence of authority only where the outcome would disclose personal data.

2.1 Channels.

2.2 Languages. English and Hindi. Where you write in another language listed in the Eighth Schedule to the Constitution, Pensieve will arrange a translation and answer in that language; this may add to the response time and Pensieve will tell you if it does.

2.3 What helps. Your name and a contact address; whether you are a Data Principal, a customer, a user or something else; what happened, with dates; what you want done; and any reference number. A grievance is never rejected for being incomplete. Pensieve asks for what it needs.

2.4 No charge. There is no fee for raising a grievance, at any stage.

2.5 No form required. A plain email is enough.

3.1 A security or safety grievance jumps the queue. A grievance alleging an unauthorised disclosure of personal data, an active security compromise, or a risk to patient safety is escalated immediately to the incident process in DIS-GL-016, and the timelines above become an outer limit rather than a target.

3.2 If Pensieve will miss a date. Pensieve tells you before it passes, with the reason and a revised date. Pensieve does not go quiet.

4.1 The process.

4.2 When it is escalated inside Pensieve. A grievance is decided above the Grievance Officer where it alleges: a personal data breach; conduct of the Grievance Officer; a matter with a potential liability above the threshold in the internal delegation of authority; or a systemic failure. It then goes to the Director, who records the decision.

4.3 Appeal. If you are not satisfied with the outcome, say so within 30 days and the decision is reviewed by a person who was not involved in it. You may also go straight to the external routes at 6; an internal appeal is not a precondition, and Pensieve will not argue that it was.

4.4 What Pensieve tells you when it does not uphold a grievance. The finding, the reasoning, the evidence relied on to the extent it can be shared, and the escalation route. Pensieve will not close a grievance without an explanation.

5.1 The position. For personal data inside a hospital's tenant, the hospital is the Data Fiduciary and Pensieve is a Data Processor. A patient's rights run against the hospital. Pensieve cannot lawfully decide, on its own initiative, to disclose, correct or erase a record held on the hospital's instructions.

5.2 What Pensieve does. Where a Data Principal contacts Pensieve about a record inside a hospital's tenant, Pensieve:

5.2.1 acknowledges within 3 Business Days and explains the position in plain language;

5.2.2 tells the individual which hospital holds the record and how to reach it, where Pensieve can identify that without disclosing personal data;

5.2.3 notifies the hospital that a Data Principal has approached Pensieve, within 3 Business Days, so the hospital's own 90-day clock is not lost;

5.2.4 provides the hospital with whatever assistance DPA-GL-001 clause 9 requires so it can answer inside its own statutory window; and

5.2.5 takes no decision on the merits.

5.3 The exception. Where the grievance alleges that Pensieve itself acted outside the hospital's instructions, an unauthorised access by Pensieve personnel, a processing Pensieve carried out for its own purposes, or a failure of Pensieve's own security, that is Pensieve's grievance to answer, and this Policy applies in full. Pensieve informs the hospital and answers the individual.

5.4 Pensieve's contact is not published to patients as a rights route. Doing so would misdirect them away from the party that actually holds the obligation. See DPA-GL-001 clause 18.3.

6.1 You may escalate at any time. Pensieve does not require you to exhaust its process first.

6.2 Pensieve will not obstruct an escalation. Pensieve does not require a complainant to sign a release, a non-disparagement undertaking or a confidentiality agreement as a condition of a remedy, and does not condition a remedy on withdrawing a regulatory complaint.

6.3 Cooperation with a regulator. Pensieve responds to a regulator's enquiry within the period the regulator sets, provides the grievance record, and tells the complainant that it has done so where it may.

7.1 The register. Every grievance is recorded with: reference, receipt date and time, complainant category, subject category, the clock applied, each communication, the decision, the reasoning, the remedy, the implementation date, the closure date, and the corrective action where any.

7.2 Retention. Grievance records are kept for 3 years from closure. See POL-GL-053 clause 7.2.

7.3 Evidence to a customer. A hospital may request the grievance record for grievances relating to its own tenant or its own users, at any time, at no charge.

7.4 Aggregate reporting. Pensieve publishes, in the Transparency Report (POL-GL-068), the number of grievances received, the categories, the number upheld, and the median and 90th-percentile time to resolution. A trust centre that publishes a grievance count of zero and no denominator is not transparent; Pensieve publishes both.

7.5 Systemic learning. Where three or more grievances in twelve months share a root cause, a corrective action is raised, tracked to closure, and reported in the same aggregate report.

8.1 Pensieve will not retaliate against anyone for raising a grievance in good faith. No credential is withdrawn, no service is degraded, no contract is terminated, no renewal is refused and no reference is withheld because a grievance was raised.

8.2 This protection extends to a hospital's employee raising a grievance about their own employer's use of the Platform. Pensieve will handle such a grievance carefully, will tell the individual what it can and cannot do, and will not disclose the individual's identity to the employer without the individual's consent unless the law requires it.

8.3 A knowingly false grievance made to cause harm is outside 8.1.

9.1 The grievance channels are usable without a Pensieve account.

9.2 The web form meets the accessibility target in POL-GL-061. Email, post and telephone are alternatives for anyone who cannot use it.

9.3 Where you need a response in a particular format, large print, a screen-reader-friendly document, a telephone call rather than a letter, say so and Pensieve will provide it.

9.4 Where you are assisted by a relative, an advocate or a guardian, Pensieve will deal with them on your written authority.

10.1 Roles.

10.2 Change of Grievance Officer. Where the individual changes, the token [TO BE SUPPLIED] is updated in the central registry, which propagates to every published document and every draft instantly, and the previous address continues to be monitored and forwarded for twelve (12) months. A stale grievance contact is a statutory failure, not an administrative one.

10.3 Review. This Policy is reviewed annually, on any change to the applicable law, and after any grievance that reveals a defect in it. The review date is 31 January 2027.