1. The promise.
The promise of this company is that we measure whether a person is getting healthier and we do not lie about the answer. Every rule below is a corollary of that promise. If you ever feel a rule and the promise are pulling in different directions, the promise wins, and you must escalate immediately.
2. Patients first, always.
Patient safety supersedes every other consideration — speed, revenue, schedule, public relations, executive convenience. If you observe a clinical risk, a privacy breach, a wallet-mint anomaly, or a chain-state inconsistency that could harm a patient, you stop, you escalate, and you document. There is no negative consequence for stopping work to flag a patient-safety concern, even if the concern turns out to be unfounded.
3. Honesty in data.
The Master Equation™ is a measurement instrument. Falsifying inputs, weighting axes off-spec, suppressing dissents, or producing a Health Credit Receipt without verifiable evidence is the most serious violation in this code. It is grounds for termination, civil claim, and referral. The receipt schema and the verification rule are not negotiable inside the company; they are negotiated by the Trust Council, in public.
4. The chain rule.
Do not propose, design, or quietly ship any change to the chain rule set, the eight-axis methodology, or the HCR schema outside the Council process. There is no expedited path. There is no skunkworks. If you believe a change is urgent, you bring a Council proposal with a written rationale and a public comment period. We have built this company precisely so the rules are not ours alone to change.
5. Money and gifts.
You may not accept gifts, entertainment, travel, or anything of value over $100 in aggregate per year from any vendor, validator institution, payer, provider counterparty, or anyone seeking to influence our decisions. Modest meals incidental to a meeting are exempt. Gifts to or from clinical patients are prohibited regardless of value. When in doubt, decline; if you cannot decline without offense, accept and donate to the Patient Hardship Fund and log it.
6. Conflicts of interest.
Disclose any outside employment, advisory role, board seat, equity holding, paid speaking arrangement, or familial relationship that could reasonably appear to influence your judgment at the company. Disclosure goes to the Compliance Office within fourteen (14) days of the conflict arising. Officers and directors disclose annually and as facts change. The Compliance Office, not your manager, decides whether the conflict is manageable, requires a recusal, or requires divestiture.
7. Confidentiality.
Patient information is HIPAA-regulated and is treated as if your own family's record were in your hands. Business-confidential information is protected, but not beyond the bounds of law: you may always disclose to a regulator, to the SEC, to law enforcement, or to your own attorney, and the company will not retaliate. You may not use confidential information for personal financial benefit; see the Insider trading policy.
8. The workplace.
We do not tolerate harassment, discrimination, retaliation, intimidation, or coercion of any kind, on any axis (race, sex, gender identity, sexual orientation, national origin, religion, age, disability, veteran status, pregnancy, parental status, political activity, union activity, or any protected category under applicable law). Bystander intervention is expected. The company funds an external ethics line — see Section 11 — that is independent of management.
9. Public communication.
Be honest, be specific, and stay in your lane. Do not represent the views of the Trust Council; the Council speaks for itself through the governance log. Do not pre-announce material non-public information, including but not limited to clinical-outcome data, regulatory action, financing transactions, or chain rule changes. The Communications Office maintains an official-spokesperson list; if you are not on it, you may not speak on the record about company business.
10. Compliance with law.
Comply with HIPAA, HITECH, GDPR, state privacy laws, FTC consumer protection, FDA software-as-a-medical-device rules where applicable, anti-kickback (42 U.S.C. § 1320a-7b), Stark, securities laws, the Foreign Corrupt Practices Act, OFAC sanctions, and the export-control rules of every jurisdiction in which we operate. When law and this code conflict, the stricter wins. When you are uncertain, ask Legal before acting.
11. How to report.
You can report any concern, suspected violation, or grey-area question through any of the following channels. You will not be retaliated against for reporting in good faith, even if the concern is not substantiated. Anonymous reporting is supported and encouraged.
- Direct supervisor — for routine clarifications.
- Compliance Office — compliance@conceptualhealth.com (monitored by the Chief Compliance Officer).
- Ethics line — 1-800-CHC-ETHIC, operated by an independent third party (NAVEX), 24/7, multilingual, anonymous by default.
- Audit Committee chair — audit-chair@conceptualhealth.com for concerns involving senior management.
- Patient Ombudsperson — ombuds@conceptualhealth.com for any patient-safety concern; the Ombuds reports to the Trust Council, not to the CEO.
Acknowledged annually. Violations are investigated by the Compliance Office, with findings reported to the Audit Committee on a quarterly basis. Material violations are disclosed in our 1-K and, where required, on Form 1-U.