Trust ethics
Human in control. Always.
Sodexo will not let a machine speak to an NHS trust in our name. Nine agent colleagues can read, draft and suggest. Only named Sodexo colleagues decide what leaves the building.
Seven commitments. Coded into the system, not written on a policy page. Every colleague can read them. Every agent colleague is bound by them.
Governance
The seven commitments.
Each commitment names what the system does, what colleagues can expect and how the commitment is enforced.
| Commitment | What it means in practice | How it is enforced |
|---|---|---|
| 1. No agent acts alone | Every campaign passes through four named colleagues before it leaves Sodexo. Draft. BD review. Marketing and risk. Named authentication. | Coded into the campaign builder. The send control stays disabled until all four stages carry a named sign-off. Steward flags any attempt to skip a stage the same day. |
| 2. Tier 2 evidence stays tier 2 unless cleared | Not every signal the agents see is safe to use externally. Tier 2 evidence is suppressed by default in anything that leaves Sodexo. | Tier 2 items are stripped automatically when a template is cloned and held in a governance queue. Release needs a named clearance at Stage 3. Steward reports tier 2 material dwelling in drafts. |
| 3. Named individuals need account-owner consent | Warmth scores and relationship notes live in the portal. No named individual is approached because an agent suggested it. | Contact steps carry the account-owner's name and cannot be authenticated by anyone else. Consent is recorded in the stage log with a timestamp. |
| 4. Every decision is traceable | Every campaign carries a stage log naming its reviewer, the time of the decision and the version of the evidence used. | The stage log is written by the system, not by hand and cannot be edited after the fact. Evidence-pack exports carry the full audit trail with them. |
| 5. Steward audits daily | Steward is the governance agent. It checks for bypass attempts, dwelling tier 2 citations, reviewer-load imbalance and stage-log gaps. | The daily audit runs against every action taken in the previous 24 hours. Breaches are surfaced to the named governance lead within one working day and shown on the governance page. |
| 6. Any colleague can raise a concern | One-click concern-raise on any campaign, any signal, any agent output. Colleagues do not need permission to question something. | A raised concern freezes the campaign before Stage 4, routes to the governance lead and is logged for the quarterly ethics review. Nothing under concern goes out. |
| 7. Any named individual can withdraw or correct their record | Any NHS executive named on the Priority-40 register can ask Sodexo to remove their record or correct anything held about them. Sodexo confirms the request within five working days and acts on it within fifteen working days. The request can be made without justification. Withdrawals remove the individual from the register, from Steward's daily audits and from any working intelligence held in the portal. | A named Data Protection Officer contact point on the Ethics page. A withdrawal or correction request form that logs the request with a timestamp and a case reference. A Steward workflow that removes or updates the record and confirms completion back to the requestor. An audit-trail entry visible on the Governance page that shows the request was received, acted on and closed within the fifteen-day window. |
The Marketing and risk reviewer role is held by S. Lilley, Y. Zimmerman and L. Fairhurst. Any of the three may act as reviewer on any given campaign.
Withdrawal and correction requests. Who to contact.
To make a withdrawal or correction request, contact dpo.uki@sodexo.com (Sodexo UK and Ireland Data Protection Office). Requests can also be made using the request form below.
Every request is acknowledged within two working days and completed inside fifteen working days. Steward logs the request and the outcome on the Governance page.
Open the request formWhat Priority-40 is not.
Deliberate scope discipline.
- Not a mass-outreach engine. Priority-40 targets 40 named trusts. Not the wider NHS. Not other sectors.
- Not a substitute for account ownership. Named account-owners keep authority. The system amplifies their judgement, it does not replace it.
- Not an autonomous agent stack. Every external action requires a signed-off named human. No exceptions.
- Not a data-hoarding project. The intake queue is governed. Colleagues own their contributions and can withdraw them.
- Not a black box. Every agent colleague declares its sources, its refresh cadence and its current confidence on the agent colleagues page in the portal.
- Not a marketing platform. It is a business development operating system with marketing as one of four reviewer roles.