Grievance & Complaints Mechanism and Whistleblower Protection policies

At Graphite Digital, we are committed to operating with integrity, transparency, and accountability across all of our work. Because of the nature of our impact in the healthcare and pharmaceutical sectors, it is essential that all stakeholders—employees, partners, clients, suppliers, and members of the public—have clear, safe, and reliable ways to raise concerns.

This page brings together two separate but complementary policies:

• The Grievance & Complaints Mechanism Policy: For raising ethical, social, environmental, or project-related concerns that may impact people, the planet, or the integrity of our work.
   
• The Whistleblower Protection Policy: For reporting serious wrongdoing, misconduct, or breaches of law, supported by confidentiality protections and non-retaliation measures.

These policies remain separate, as they serve different purposes and meet different compliance requirements under B Corp and EcoVadis, but are presented in a unified place for ease of access and transparency.

Purpose

This policy outlines the process for any individual—internal or external—to raise concerns, complaints, or grievances relating to the ethical, social, or environmental impact of our work, or to report any behaviour or actions that may conflict with our company values, our B Corp and EcoVadis commitments, or applicable laws and regulations.

We recognise that as an organisation working with clients in the healthcare and pharmaceutical sectors, our work can have far-reaching implications for people and the planet. This mechanism ensures transparency, accountability, and a clear route for resolving concerns in a fair and responsible way, in alignment with our ongoing commitments to ethical business practices and continuous improvement under both the B Corp and EcoVadis frameworks.

Scope

This policy applies to:

• All employees, contractors, and freelancers working with our company.
• Clients, suppliers, and other external stakeholders who may be impacted by or wish to report a concern about our work.

Principles

Our grievance and complaints mechanism is based on the following principles:

• Accessibility – Anyone can raise a concern through the channels provided, regardless of their role or relationship with us.
• Confidentiality – All complaints will be treated with strict confidentiality and only shared with those directly involved in the investigation and resolution process.
• Non-retaliation – No one will be treated unfairly or face negative consequences for raising a concern in good faith.
• Fairness – Complaints will be investigated impartially and outcomes will be based on facts and evidence.
• Transparency – We will communicate outcomes and corrective actions, where appropriate, to all relevant parties.

How to raise a concern

This process is intended for general ethical, sustainability, or operational concerns that do not constitute serious wrongdoing or legal breaches, which should be reported under the Whistleblower Protection Policy below.

• Internal complaints:
  Employees should raise concerns with their line manager or the Senior Leadership Team. Concerns may relate to unethical project work, conflicts of interest, environmental impact, working practices, or breaches of company policy.
• External complaints:
  Clients, suppliers, partners, or members of the public may submit complaints via our contact page or by emailing contact@graphitedigital.com.
• Anonymous submissions:
  Concerns may be submitted anonymously; however, providing contact details allows us to investigate more effectively and communicate the outcome.

Investigation and resolution

• All complaints will be acknowledged within 5 working days.
• The issue will be reviewed by a member of the Senior Leadership Team (or a delegate with no conflict of interest).
• An investigation will be conducted as appropriate, with input from relevant stakeholders.
• A written response outlining findings and actions will be provided within 30 working days, where possible.

Outcomes and continuous improvement

We commit to:

• Taking corrective actions where necessary to address substantiated concerns.
• Using complaints data to improve our policies, project selection processes, and risk management.
• Reporting transparently on the number and nature of complaints, where appropriate, in our B-corp annual impact reporting.

Ethical conduct, lobbying and advocacy

Graphite Digital does not engage in lobbying or political advocacy activities on behalf of any political party, candidate, or government entity. We maintain a neutral position in political matters and do not make political donations.

Should we engage in advocacy relating to healthcare, digital ethics, or sustainability, it will always be in alignment with our company values, our B Corp and EcoVadis commitments, and based on evidence-led, ethical principles.

Our approach to any engagement with government or regulatory stakeholders is rooted in transparency and integrity. We will publicly disclose the nature and purpose of such activities, where applicable, and ensure they aim to contribute positively to society and the sectors we serve.

Issued: November 2025

Purpose

This policy provides protection and a clear process for employees and other stakeholders to disclose concerns about wrongdoing or misconduct without fear of reprisal. It ensures that anyone can raise genuine concerns about activities that could harm people, the environment, or our integrity as a responsible business committed to the highest ethical and sustainability standards, including those required by our B Corp certification and EcoVadis accreditation.

Scope

This policy applies to:

• All employees, contractors, and freelancers working with our company.
• Clients, partners, suppliers, and other external stakeholders who become aware of potential wrongdoing connected to our work.

Qualifying disclosures

A qualifying disclosure is one made in good faith where the individual reasonably believes that the information shows one or more of the following:

• A criminal offence has been, is being, or is likely to be committed.
• There has been, is, or is likely to be a failure to comply with a legal or regulatory obligation.
• A miscarriage of justice has occurred or may occur.
• Someone’s health or safety has been, is being, or is likely to be endangered.
• The environment has been, is being, or is likely to be damaged.
• There has been deliberate concealment of any of the above.

How to raise a concern

This process applies to serious wrongdoing distinct from general grievances.

• Internal complaints:
  Concerns should be reported to the Senior Leadership Team via contact@graphitedigital.com. All disclosures will be handled with sensitivity and confidentiality.
• External complaints:
  Clients, suppliers, partners, or members of the public may submit complaints via our contact page on the website or emailing contact@graphitedigital.com.
• Escalation and external reporting
  If the individual believes their concern has not been appropriately addressed internally, or if it involves senior leadership, they may report directly to the relevant regulatory body, authority, or an independent whistleblowing organisation.

Protection and non-retaliation

We are committed to ensuring that:

• Individuals making disclosures in good faith will not face dismissal, discrimination, or any form of retaliation.
• Allegations of victimisation against whistleblowers will be investigated and may lead to disciplinary action.
• False or malicious allegations may themselves be subject to investigation.

Investigation and resolution

• Reports will be acknowledged within 5 working days.
• The issue will be reviewed by a member of the Senior Leadership Team (or a delegate with no conflict of interest).
• An investigation will be conducted as appropriate, with input from relevant stakeholders.
• Findings and any resulting actions will be communicated appropriately within 30 working days, subject to confidentiality requirements.

Ethical marketing

We are committed to ensuring that all marketing and communications are honest, responsible, and aligned with our ethical principles and sustainability commitments. Our marketing practices must never mislead, exaggerate, or make false claims about our services, our clients, or the impact of our work.

Any concerns regarding unethical marketing, misrepresentation, or communication that could misinform stakeholders may be raised through this whistleblowing mechanism or via our grievance process. Such disclosures will be treated with the same level of protection, confidentiality, and non-retaliation outlined in this policy.

Public commitment

We believe that transparency, integrity, and accountability are essential to maintaining trust with our clients, employees, and the public. This policy is published externally to demonstrate our commitment to ethical business practices and to provide clear channels for anyone to raise legitimate concerns safely and responsibly.

Issued: November 2025