#Human Rights Policy

1.1 The commitment. Pensieve shall respect internationally recognised human rights across its own activities and its business relationships. Respect means Pensieve avoids causing or contributing to adverse human rights impacts, addresses impacts it is involved in, and seeks to prevent or mitigate impacts directly linked to its operations, products or services, even where it has not contributed to them. This is the corporate responsibility to respect in Pillar II of the Guiding Principles (Guiding Principles 11 to 24). Pensieve commits to respect these rights; it does not represent that it can guarantee their enjoyment by every person its value chain touches, and it distinguishes the two deliberately.

1.2 The frameworks. Pensieve aligns its conduct with, and draws its standard from:

1. the International Bill of Human Rights: the Universal Declaration of Human Rights, the International Covenant on Civil and Political Rights, and the International Covenant on Economic, Social and Cultural Rights;
2. the International Labour Organization Declaration on Fundamental Principles and Rights at Work (1998, as amended 2022) and its underlying fundamental Conventions;
3. the United Nations Guiding Principles on Business and Human Rights (2011);
4. the ten principles of the United Nations Global Compact;
5. the OECD Guidelines for Multinational Enterprises on Responsible Business Conduct (2023), including the 2023 expectations on the design, development and use of technology; and
6. the United Nations B-Tech Project of the Office of the High Commissioner for Human Rights, which applies the Guiding Principles to the technology sector and is the reference Pensieve uses for its product-specific and end-use human rights risks.

Pensieve aligns with these frameworks and commits to respect the rights they protect. It does not claim to be certified, accredited, or a filing participant under any of them, and it does not represent that it has submitted a UN Global Compact Communication on Progress.

1.3 The ILO fundamental principles, stated honestly. The five fundamental principles are: freedom of association and the effective recognition of the right to collective bargaining; the elimination of forced or compulsory labour; the effective abolition of child labour; the elimination of discrimination in employment and occupation; and a safe and healthy working environment (added in 2022). These principles bind every ILO member State by virtue of membership, whether or not the underlying Convention has been ratified. India has not ratified ILO Convention 87 (Freedom of Association) or Convention 98 (Right to Organise and Collective Bargaining). Pensieve therefore commits to respect the fundamental principles, including freedom of association, and does not claim that its home jurisdiction has ratified every fundamental Convention. Overstating the ratification position would be a misrepresentation, and Pensieve does not make it.

1.4 Approval and availability. This Policy is approved at the most senior level of Edsol Edtech Pvt. Ltd., as Guiding Principle 16 requires, and is published at https://trust.pensievelabs.org. It is communicated to personnel and made available to business partners. It is owned by Legal and reviewed under 10.

2.1 Why a salient-risk set, not a claim of full coverage. A credible policy for a company of Pensieve's size identifies the small number of rights where its potential impact is most severe, rather than asserting that it manages every right equally. The set below is drawn from the B-Tech Project's technology-sector risks and narrowed to a health-software company that processes clinical data on behalf of hospitals.

2.2 Where Pensieve sits in the chain of responsibility. The Guiding Principles distinguish impacts a company causes, impacts it contributes to, and impacts directly linked to its operations, products or services through a business relationship. The distinction governs what Pensieve must do:

2.2.1 where Pensieve causes or contributes to an adverse impact, it provides for or cooperates in remediation under 7;

2.2.2 where an impact is directly linked to Pensieve through a business relationship but Pensieve did not cause or contribute to it, Pensieve uses its influence to seek to prevent or mitigate the impact, and is not thereby the party required to provide the remedy.

Pensieve's largest potential impacts by volume run through its cloud and platform providers, to which it is directly linked and over which a company of its size has limited influence. It says so rather than implying control it does not hold.

3.1 Proportionate by design. Guiding Principle 17 makes the scope of human rights due diligence proportionate to a company's size, the severity of its potential impacts, and its operating context. Pensieve runs a due diligence process scaled to a company of [TO BE SUPPLIED] people with a short, mostly digital value chain. It does not claim exhaustive value-chain mapping, independent human rights impact assessments of every release, or supplier audit programmes it cannot resource.

3.2 The process. Pensieve's due diligence follows the ongoing cycle in Guiding Principles 17 to 21:

3.3 Consultation. Where a salient risk bears on a specific affected group, Pensieve seeks the view of that group or its credible representatives to the extent proportionate to the risk. For a company of its size this is direct engagement, not a standing stakeholder-panel programme, and Pensieve describes it as what it is.

4.1 End-use is a human rights question. The B-Tech Project treats the end-use of a technology product as a source of human rights risk that a responsible company must assess, not only the conduct of its immediate counterparty. Pensieve applies this before it sells.

4.2 The pre-contract screen. Before entering a contract, Pensieve shall assess the prospective buyer and the intended use of the Platform against the prohibited and restricted uses in the Use Case Restrictions and Prohibited Uses (ADD-GL-005). Where the intended use would cause or contribute to a severe adverse human rights impact, and the risk cannot be mitigated through restriction, configuration or contract, Pensieve shall decline the engagement. Pensieve does not restate the prohibited-use list here; ADD-GL-005 owns it, and the restrictions that survive the screen flow into the contract.

4.3 Influence, not endorsement. Pensieve's influence over how a hospital uses the Platform is real but bounded: it exercises it through use restrictions, configuration limits, the AI use restrictions in POL-GL-060, and the right to act on a credible report of misuse. Selling the Platform is not an endorsement of every act a customer performs with it, and Pensieve retains the remedies in its agreements where a customer's use breaches ADD-GL-005.

5.1 The commitments. Within its own workforce Pensieve shall: engage no forced, bonded, indentured or involuntary labour and no child labour; not discriminate in employment on any protected ground; not tolerate harassment, threats or abuse; respect freedom of association; pay at least the applicable statutory minimum wage through the banking system; and provide a safe and healthy working environment, including for personnel deployed on a hospital site.

5.2 Where each commitment is operated. These commitments are not restated in operational detail here. They are operated through:

5.3 Freedom of association. Every person engaged by Pensieve is free to associate, or not to associate, and to raise a concern about working conditions without detriment, through the whistleblowing route in POL-IN-308. Pensieve does not require any person to waive this freedom.

6.1 What Pensieve requires of suppliers. Pensieve's requirements of its suppliers, subcontractors and subprocessors are set out in the Supplier Code of Conduct (POL-GL-071) and are not restated here. Its modern slavery and ethical sourcing position, including the tiered supply-chain risk assessment, is owned by the Modern Slavery and Ethical Sourcing Statement (STM-GL-031). Inbound assessment of vendors that touch Pensieve's own operations is governed by the Vendor and Third-Party Risk Management Policy (POL-GL-120).

6.2 The influence asymmetry, stated openly. Pensieve's supplier base is dominated by large cloud and software vendors that will not countersign a small customer's code. Pensieve does not pretend otherwise. It segments its suppliers and applies the mechanism it can actually operate:

6.2.1 for large infrastructure and software providers, Pensieve conducts due diligence by reference, assessing the provider against its own published human rights and labour commitments, its certifications and its third-party attestations, and recording that assessment. Its influence here is selection and continued custom, not signature or audit rights;

6.2.2 for smaller vendors and subcontractors, where Pensieve has genuine influence, it requires acceptance of POL-GL-071 as a contract term, with the right to ask questions and to terminate for a serious unremedied breach.

Pensieve does not claim audit rights over, or enforcement of its code against, hyperscale providers, because that claim would not be true.

6.3 How mandatory value-chain due diligence laws reach Pensieve. A hospital customer in the European Union, Norway or elsewhere may itself be subject to a mandatory human rights and environmental due diligence law and may ask Pensieve for information as a link in its value chain. None of these laws imposes a direct duty on Pensieve, which is far below every threshold: the EU Corporate Sustainability Due Diligence Directive (Directive (EU) 2024/1760, as amended by Directive (EU) 2026/470) applies to enterprises above 5,000 employees and EUR 1.5 billion net turnover; the EU Corporate Sustainability Reporting Directive applies above 1,000 employees and EUR 450 million net turnover; and Norway's Transparency Act binds larger enterprises and does not impose a direct duty on a mere foreign supplier. Pensieve supports these instruments and responds to value-chain data requests from covered customers, drawing on this Policy and the artefacts it references. It does not represent itself as a regulated entity under any of them. [UNVERIFIED: the first-application dates of the amended EU Directives are still settling and should be confirmed against the amending Directive before any date is quoted; they are not relied on here because the Directives do not apply to Pensieve directly.]

7.1 The remedy route. Anyone who believes a Pensieve act or omission has adversely affected their human rights may raise a grievance through the Grievance Redressal Policy and Grievance Officer Notice (POL-GL-066). That Policy owns the channels, the acknowledgement and response timelines, the routing rule for grievances about a hospital's own processing, the external escalation routes, and non-retaliation. It is designed against the eight effectiveness criteria in Guiding Principle 31: legitimate, accessible, predictable, equitable, transparent, rights-compatible, a source of learning, and based on engagement. This Policy does not restate those mechanics.

7.2 Remediation. Consistent with Guiding Principle 22, where Pensieve has caused or contributed to an adverse human rights impact, it shall provide for or cooperate in remediation through a legitimate process, and shall prioritise the safety and remediation of the affected person over commercial or reputational considerations. Where an impact is directly linked to Pensieve through a business relationship without Pensieve having caused or contributed to it, Pensieve shall use its influence to seek prevention or mitigation, and will engage the party responsible rather than disengage abruptly where abrupt disengagement would worsen the position of the affected people.

7.3 Reporting a concern. A human rights concern, including one raised anonymously, may be reported to info@pensievelabs.org or, for a matter involving Pensieve personnel or a suspected wrongdoing, through the whistleblowing route in POL-IN-308 and the reporting channel published with POL-GL-059. No person who raises a concern in good faith will suffer any detriment, whether or not the concern is upheld.

8.1 Pensieve publishes this Policy and its related statements openly, rather than releasing them on request. A company that will only state its human rights position behind a login has said something about that position.

8.2 Pensieve reports the aggregate volume of grievances and rights requests, with a denominator, in the Transparency Report (POL-GL-068). It does not publish a headline figure without the context that makes it meaningful, and it does not assert a satisfaction figure it cannot evidence.

8.3 Where a concern is raised, Pensieve communicates enough for the affected person or their representative to evaluate the adequacy of its response, without disclosing information that would put an affected person at risk or breach a confidentiality obligation.

9.1 Candour is the point of this clause. The table states Pensieve's maturity as at 03 August 2026, for a company of [TO BE SUPPLIED] people, and marks what is deliberately not built.

9.2 Where an element above moves from "not in place" to "in place", it will be recorded in the change history and the maturity table updated. Pensieve does not describe a control that does not yet exist as though it did.

10.1 Roles.

10.2 Exceptions. Any exception to this Policy must be approved in advance by the Director, recorded in the exception register (REG-GL-210) with the reason, the scope, the compensating measure and an expiry date, and reviewed on expiry. No exception may authorise conduct that would cause or contribute to a severe adverse human rights impact.

10.3 Enforcement. For personnel, a breach of this Policy is a disciplinary matter under POL-GL-322 and may amount to a breach of the code of conduct at POL-IN-305. For suppliers, the consequences of breach are those in the Supplier Code of Conduct (POL-GL-071), ending at termination for a serious unremedied breach.

10.4 Review. This Policy is reviewed at least annually, on any material change to the Platform, the data it processes or a market Pensieve enters, and after any grievance that reveals a defect in it. The next review date is 03 August 2027.