#Supplier Code of Conduct

1.1 Two segments, two mechanisms. Pensieve's supplier base divides into two segments, and this Code applies to each by the mechanism Pensieve can actually operate against it.

1.2 Why the segmentation is stated openly. A code that asserted uniform signature and audit rights over every supplier would be untrue for the largest ones, and would mislead a hospital that relied on it. Pensieve states which mechanism applies to which supplier so that the Code means what it says. The absence of a countersignature from a Segment A provider is not a gap in this Code. It is the correct treatment of a supplier Pensieve does not control, and the assessment-by-reference record under POL-GL-120 is the evidence that stands in its place.

1.3 The one obligation that binds every segment. Where a Supplier processes personal data on Pensieve's behalf, the data protection terms in 6.4 flow down by contract to that Supplier regardless of segment, because the law requires it and because infrastructure providers accept these terms in their standard data-processing addenda. This is the single point at which flow-down works against a hyperscale provider, and Pensieve uses it.

1.4 Acceptance and its record. For a Segment B Supplier, acceptance of this Code is recorded as a signed acknowledgement, a clause in the engagement contract, or an express reference in the purchase order, before the engagement begins, and the record is retained for the period in the frontmatter. A Segment A provider is not asked to sign; the assessment record under POL-GL-120 stands in place of acceptance. Test: for every Segment B Supplier there is a dated acceptance record; for every Segment A provider there is a dated assessment record.

These are the labour standards Pensieve holds itself to under the Modern Slavery and Ethical Sourcing Statement (STM-GL-031) and the Child and Forced Labour Prohibition Statement (POL-IN-315), applied outward. Pensieve does not require a Segment B Supplier to run an enterprise labour-audit programme. It requires the Supplier to meet these standards and to be able to show, through its ordinary records, that it does.

2.1 Forced labour. The Supplier shall not use or permit forced, bonded, indentured, trafficked or prison labour, or any work that is not freely chosen. The Supplier shall not retain a worker's identity documents, passport or certificates, charge a worker any recruitment fee, deposit or bond, or restrict a worker's freedom of movement or freedom to leave employment on reasonable notice. Test: every worker holds their own documents, paid no fee to be hired, and can leave on contractual notice.

2.2 Child labour. The Supplier shall not employ any person below the minimum age for work under the law of the place of employment, and shall not employ any person below eighteen years of age in hazardous work. Where the Supplier employs young workers above the minimum age, it shall observe the applicable limits on their hours and duties. Test: date-of-birth records exist for the youngest workers and meet the local minimum age.

2.3 Wages. The Supplier shall pay every worker at least the applicable statutory minimum wage, through a traceable payment method, on the due date, without any unlawful deduction, and shall provide each worker a wage statement. Test: wage records reconcile to the statutory floor and to a bank or equivalent payment trail.

2.4 Working hours. Working hours, including overtime, shall comply with applicable law. Overtime shall be voluntary and paid at the applicable rate. Test: hours records show compliance with the legal maximum and overtime consent.

2.5 Non-discrimination. The Supplier shall not discriminate in hiring, pay, training, promotion or termination on the ground of race, caste, colour, religion, sex, gender, sexual orientation, disability, pregnancy, age, national or social origin, political opinion, marital status, or trade-union membership.

2.6 Humane treatment and harassment. The Supplier shall not permit harassment, sexual harassment, threats, intimidation, corporal punishment, or physical, verbal or psychological abuse of any worker, and shall operate a route by which a worker can raise a concern without detriment.

2.7 Freedom of association. The Supplier shall respect every worker's freedom to associate, or to decline to associate, and to bargain collectively where the law provides, without reprisal. Where the law of the place of work restricts these freedoms, the Supplier shall not obstruct a lawful alternative means for workers to raise and resolve workplace concerns.

3.1 A safe working environment. The Supplier shall provide a working environment that is safe and healthy, identify and control foreseeable hazards, and comply with applicable occupational health and safety law. This reflects the fifth ILO fundamental principle, a safe and healthy working environment, added in 2022.

3.2 On Pensieve or hospital premises. Where the Supplier's personnel work on Pensieve premises or, with authorisation, on a hospital site, they shall follow the site's safety, infection-control and confidentiality rules, including those Pensieve applies to its own on-site personnel under the Health, Safety and Vaccination Policy for On-Site Staff (POL-IN-319) and the On-Site Personnel Conduct and Patient Confidentiality Undertaking (POL-IN-318).

3.3 Preparedness and recording. The Supplier shall hold arrangements proportionate to its size for emergencies affecting its workers, and shall record and act on work-related injuries and illness. Test: where an incident occurs, a record of it and of the action taken exists.

4.1 Anti-bribery. The Supplier shall not offer, promise, give, solicit or accept any bribe, kickback or improper advantage, whether to a public official or a private party, directly or through a third party, in connection with any Pensieve business. Pensieve's own position is the Anti-Bribery and Anti-Corruption Declaration (STM-GL-030), and the Supplier is required to meet a standard no less strict.

4.2 Facilitation payments. The Supplier shall not make facilitation payments, meaning small unofficial payments to secure or speed a routine action, in connection with Pensieve business, even where local practice tolerates them.

4.3 Gifts and hospitality. The Supplier shall not offer any Pensieve person a gift, hospitality or benefit that is intended, or could reasonably be seen, to influence a Pensieve decision. Modest, occasional and transparent hospitality in the ordinary course is not prohibited; anything that could not be disclosed openly is. Test: any gift or hospitality above a nominal value is one the recipient could record and disclose.

4.4 Conflicts of interest. The Supplier shall disclose to Pensieve any actual or potential conflict of interest, including a personal relationship between the Supplier's personnel and a Pensieve person involved in the engagement, before it can affect a decision. Pensieve's internal position is the Conflict of Interest Declaration (STM-IN-017).

4.5 Fair dealing and records. The Supplier shall compete fairly, shall not misrepresent its capabilities, certifications or attestations, and shall keep accurate books and records of its transactions with Pensieve. Test: the Supplier's invoices and deliverables reconcile to what was agreed.

5.1 Sanctions. The Supplier shall comply with the trade sanctions and asset-freeze measures applicable to it, and shall not, in performing a Pensieve engagement, deal with a sanctioned party or in a sanctioned jurisdiction in a manner that would place Pensieve in breach. The Supplier shall notify Pensieve if it, or any of its beneficial owners or key personnel, becomes a designated party.

5.2 Export control. Where the Supplier provides technology, software or technical services subject to export-control law, it shall comply with that law and shall not cause Pensieve to breach it. Pensieve's own position is the Sanctions and Export Control Declaration (STM-GL-032), and the Supplier is required to be consistent with it.

5.3 Screening evidence, sized to the supplier. On Pensieve's request, the Supplier shall confirm in writing that it is not a designated party and is not owned or controlled by one. For a small Segment B Supplier this is a written confirmation, not a screening-programme audit.

6.1 Tiered by exposure. The obligations in this clause scale with what the Supplier can access.

A Supplier whose tier is uncertain is treated as the higher tier until determined.

6.2 Baseline. Every Supplier shall protect any Pensieve information it holds against loss and unauthorised access, use that information only for the engagement, and return or delete it on request or at the end of the engagement.

6.3 Confidential information and system access. A Supplier with access to Pensieve confidential information or systems shall implement appropriate technical and organisational measures proportionate to the sensitivity of what it holds, restrict access to personnel who need it, hold those personnel to a confidentiality obligation, and notify Pensieve without undue delay of any security incident affecting Pensieve information. Personnel with access to Pensieve systems are held to the controls in POL-GL-120 Section 4.4: named identity, phishing-resistant authentication, and the production-access process where it applies.

6.4 Subprocessors and flow-down. A Supplier that processes personal data on Pensieve's behalf is a subprocessor and shall:

6.4.1 process that data only on Pensieve's documented instruction, and only as the engagement needs;

6.4.2 be under a written contract imposing data protection terms no less protective than the Data Processing Agreement (DPA-GL-001), which is the mechanism through which the obligations the law places on a processor, including those under Article 28 of the General Data Protection Regulation for the European Economic Area and under the Digital Personal Data Protection Act, 2023 for India, are passed down;

6.4.3 not engage a further subprocessor without Pensieve's prior authorisation under the Subcontractor and Subprocessor Approval Schedule (ADD-GL-022), and shall impose equivalent terms on any subprocessor it is authorised to engage;

6.4.4 notify Pensieve of a personal data breach without undue delay, so that Pensieve can meet its own notification commitment in the Incident Response and Breach Notification Commitment (DIS-GL-016);

6.4.5 assist Pensieve with data-principal rights, and with deletion and return, consistent with DPA-GL-001 and the Data Deletion and Return Disclosure (DIS-GL-023).

6.5 The register governs subprocessors. A Supplier that is a subprocessor is recorded in the public Subprocessor Register (DIS-GL-009) and is governed by the Sub-Processor Management Policy (POL-GL-135), which owns the notification, objection and register-maintenance rules. This Code does not restate them.

6.6 No impossible warranty. Pensieve does not require a Supplier to warrant that its systems cannot be breached, because no such warranty is truthful. It requires implemented, proportionate measures and honest, prompt notification when something goes wrong. Pensieve holds no security certification itself, and does not treat a Supplier's absence of one as disqualifying; it is assessed and scored under POL-GL-120, not used as a gate.

7.1 Compliance and proportionate care. The Supplier shall comply with applicable environmental law, hold the permits its operations require, and manage its waste, emissions and hazardous materials lawfully. This mirrors the environment section of the reference supplier-code structure and Pensieve's own position in the Environmental and Sustainability Policy (POL-GL-070).

7.2 What Pensieve actually asks for. Pensieve is a software company with no factory, fleet or data centre of its own, and it asks of a Supplier only what is proportionate to the Supplier's activity:

7.2.1 from an infrastructure provider, per-customer carbon reporting and published energy and efficiency data, assessed by reference under 1.1 against the provider's own disclosures, which Pensieve does not present as audited;

7.2.2 from a hardware or equipment vendor, environmentally sound end-of-life handling and, in India, channelling of electrical and electronic waste to a registered recycler consistent with the E-Waste (Management) Rules, 2022;

7.2.3 from a Segment B service supplier, no more than lawful operation and an honest answer to a proportionate question.

7.3 No overclaim required or made. Pensieve does not require a Supplier to hold an environmental certification, claim carbon neutrality, or purchase offsets, and Pensieve makes none of those claims itself. Where a Supplier states an environmental credential, it shall be able to evidence it.

8.1 Authorisation. A Segment B Supplier shall not subcontract the performance of a Pensieve engagement, in whole or in material part, without Pensieve's prior written authorisation. Subcontracting that involves personal data additionally follows 6.4.3 and ADD-GL-022.

8.2 Flow-down. Where a Supplier is authorised to subcontract, it shall impose on its subcontractor terms no less protective than this Code, and shall remain responsible to Pensieve for the subcontractor's performance. A Supplier cannot discharge an obligation under this Code by delegating it.

8.3 Visibility. The Supplier shall, on request, identify the subcontractors it uses for a Pensieve engagement, so that a hospital's data reaching a fourth party is visible rather than hidden. For a subprocessor, this identification is part of the assessment under POL-GL-135. Test: for any engagement, Pensieve can obtain the list of subcontractors involved.

9.1 Evidence proportionate to size. Pensieve's evidence expectation scales with the Supplier's size and exposure, and is set deliberately at a level a very small supplier can meet.

9.2 The reserved right, and its limits. Pensieve reserves the right, on reasonable notice, to ask a Segment B Supplier for evidence of compliance with this Code and, where a serious concern is credibly raised, to verify it. Pensieve does not assert an audit right over a Segment A provider, because it has none and could not exercise it. A two-person supplier is never asked for an enterprise assurance report; it is asked to answer honestly and to show its ordinary records.

9.3 Proportionate requests. Pensieve limits what it requests of a small Supplier to what the engagement's risk warrants. When Pensieve is itself asked by a covered customer for value-chain information, it answers within the proportionate ceiling those laws set, and it applies the same restraint when it asks a small Supplier for information.

9.4 Accuracy of evidence. Any certification, attestation or answer a Supplier gives Pensieve shall be accurate and current. Misrepresenting a credential is a serious breach under 11.

10.1 The route. A Supplier, or a worker of a Supplier, who has a concern about Pensieve's conduct, about conditions on a Pensieve engagement, or about a breach of this Code, may raise it with Pensieve at info@pensievelabs.org, or through the Grievance Officer at info@pensievelabs.org under the Grievance Redressal Policy and Grievance Officer Notice (POL-GL-066). A concern about suspected wrongdoing may be raised through the whistleblowing route in the Whistleblower and Grievance Policy (POL-IN-308) and the channel published with the Vulnerability Disclosure Policy (POL-GL-059).

10.2 Anonymous concerns. A concern may be raised anonymously. Pensieve investigates an anonymous concern, but cannot report the outcome to, or verify facts with, a person it cannot contact, and says so.

10.3 Non-retaliation. Pensieve shall not terminate, penalise or withhold payment from a Supplier, and requires the Supplier not to retaliate against its own worker, for a concern raised in good faith, whether or not the concern is upheld. This mirrors the protection Pensieve gives every complainant under POL-GL-066.

10.4 No waiver as a condition. Pensieve does not require a Supplier, or a Supplier's worker, to waive the right to raise a matter with a regulator or a court as a condition of engagement, payment or settlement.

11.1 Proportionate response. Pensieve's response to a breach of this Code is proportionate to the breach and to the leverage Pensieve holds over the Supplier.

11.2 Remediation before termination. For a Segment B Supplier, Pensieve prefers remediation to termination where the affected people, including the Supplier's own workers, would be worse off if Pensieve disengaged abruptly. This follows the same principle as STM-GL-031: the safety and remediation of an affected person comes before Pensieve's convenience or reputation. Termination is the end of the path, not the first step.

11.3 Termination. A serious breach that is not remedied within the period Pensieve sets, a breach of the data protection obligations in 6.4, or a Supplier becoming a sanctioned party, entitles Pensieve to terminate the engagement in accordance with the governing contract, and to remove a subprocessor under POL-GL-135.

11.4 Record. Every breach, its remediation and its outcome are recorded, so that the Supplier's next assessment under POL-GL-120 reflects its actual conduct.

12.1 Roles.

12.2 Exceptions. Per POL-GL-000 Section 5. No exception is available to the data protection flow-down at 6.4, or to the sanctions obligation at 5. A Segment A provider's refusal to sign this Code is not an exception; it is the expected case, handled by assessment by reference under 1.1. A required term that a Segment B supplier will not accept is either a recorded, accepted gap with a compensating control under POL-GL-120 Section 4.3.4, or a refusal to engage.

12.3 Enforcement. Evidence of compliance is the acceptance records, the assessments under POL-GL-120, the Subprocessor Register (DIS-GL-009), the Third-Party Contract Register (REG-GL-212), and the breach records under 11.4. Engaging a supplier that receives hospital data without the assessment and terms this Code requires is a breach of the Acceptable Use Policy (POL-GL-102) and a reportable security event.

12.4 Review. This Code is reviewed at least annually, on entry into a market that requires a new class of supplier, and after any supplier breach that reveals a defect in it. The next review date is 03 August 2027.