For a health system rather than a single hospital.

eHospital from the National Informatics Centre runs on the government cloud. eSushrut from the Centre for Development of Advanced Computing runs in the institutes and in state-wide programmes, and a lighter edition of it now reaches small providers. Both are aligned to the national digital health mission, both are already installed, and neither costs a facility anything. A supplier who cannot say what that leaves a department holding has not understood what the department is being asked to do.

So the boundary, stated plainly. If the requirement is software for a building, the free option is a rational choice and we will say so in the room. The case for Pensieve begins where the unit of administration stops being the building: one person across every facility in the estate, one access decision over all of it with a record of every access that can be read months later, and scheme, quality and statutory evidence produced by the work rather than compiled as a return.

A facility system administers a facility. It is not a criticism of one to observe that a department is not a facility.

A package rate is a fixed amount for a procedure drawn from a national master, modified by where the facility sits and by the quality certificate it holds, and reserved or blocked for certain provider types. The quality modifier alone is 10 percent at entry level and 15 percent at full accreditation. Source 23 Vault applies the rate book that applies to the event, rather than asking a clerk to remember which one it was.

A state scheme may adjudicate through the national system, may top it up, or may run its own empanelment and its own portal entirely. Each is a payer with its own rate book and its own route out, configured in the platform and carried over the same outbound bridge as every other external connection. The routing is data, so a second state is a configuration rather than a version of the product.

The central government health scheme, the ex-servicemen scheme and the employees’ insurance scheme each carry their own package master and their own claim route, and a district hospital meets all of them in the same week as it meets cash and a corporate book. One clinical event, priced against each of them, from the same record.

A facility on the national registry earns a published incentive for each digitised record it links above a monthly threshold, and for each claim transacted through the national exchange. Source 25 Pensieve is built to participate in both. Whether a given facility qualifies is the department’s determination rather than ours, and we will not price a proposal on it.

Under India’s data protection law the institution is the data fiduciary and Pensieve is the processor. The processing addendum binds us to act on the institution’s documented instructions except where the law requires otherwise, and nothing in the software is built as though the record were ours.

Pensieve reads HL7 v2, FHIR R4 and DICOM, which is exactly why it can write them. An export leaves on the standards the data arrived on rather than as a dump a successor supplier has to reverse engineer, and it stays available for the whole term rather than becoming a negotiation at the end of one.

How Pensieve comes out is written down in the same detail as how it goes in. A department that cannot read the exit before it signs is being asked to take the exit on trust, and that is the position this page exists to refuse.

The bridge lets Pensieve run beside what a facility already has, over one outbound connection, speaking the protocols those systems already speak. Where an installed system is doing its job it keeps doing it, and Pensieve reads it.

The record sits on Google Cloud in region asia-south1, in India, co-located with the database. For a department reasoning about the Digital Personal Data Protection Act, the answer to where the data lives has to be a region rather than a reassurance. It is also the easy half of the question.

The department has to be able to prove, afterwards, on what basis each access happened. Consent is a modelled object the access check reads on every read and every write, an admission is the other half of that decision, and both a grant and a withdrawal are audited inside the transaction that made them. An administrator can see who currently holds access to one patient, everything one member of staff can reach, and what a proposed permission change would do before it is made.

One binary inside the estate opens one outbound, mutually authenticated connection. No inbound port is opened at any facility and no listener is exposed, which is what a state network team is actually being asked to approve. Machine traffic queues in a local outbox through an outage and delivers on reconnect.

We hold no data protection certificate, because there is none to hold, and using Pensieve does not by itself make an institution compliant with anything. Compliance is a property of how the institution operates. What we publish is the mechanism and the documents that bind us to it: the security addendum, the data residency statement and the processing addendum, each versioned, dated and hashed.