Integrity starts with relationships.

01 / PURPOSE AND SCOPE

Integrity is a practice, not a label.

This page brings together references for Caristeo’s relationships with people, clients, partners, suppliers and public authorities. Its scope is institutional: it does not replace law, specific contracts, policies that have not yet been approved or legal assessment. Caristeo intends to document its integrity evolution with clear evidence and scope, without anticipating controls that have not been formalized.

The structure was written as proportionate guidance and draws on Brazil’s Office of the Comptroller General (CGU) materials for private companies. This does not mean enrollment in CGU programs, seals or assessments.

02 / PRINCIPLES AND CONDUCT

Responsibility shows up in choices.

Integrity should guide how an opportunity is assessed, how information is recorded and how relationships are conducted. These are reference principles for decisions and future approved policies:

• Reject corruption, bribery, improper payments and improper advantages, directly or indirectly.
• Recognize and address conflicts of interest before they influence a decision.
• Act with transparency, good faith and respect for applicable law in commercial and institutional relationships.
• Keep records and information accurate, contextually complete and protected from manipulation.
• Respect people, rights, privacy, security and a workplace free from harassment and discrimination.

Conduct that needs concrete attention.

Integrity becomes meaningful when applied to real situations. Until formal rules are approved and published, the references below do not replace legal or contractual criteria:

• Anti-corruption and anti-bribery: do not offer, promise, authorize, request or accept an improper advantage.
• Conflicts of interest: disclose relationships, interests or circumstances that may compromise impartiality.
• Gifts and hospitality: assess purpose, proportionality, transparency and context before offering or accepting; formal criteria and limits have not been published.
• Public sector: conduct every interaction lawfully, transparently and without seeking improper influence.
• Fair competition: do not seek or share competitively sensitive information improperly, or coordinate practices that restrict competition.
• Records and information: do not falsify, misleadingly omit or use confidential information outside an authorized purpose.
• Privacy and security: handle information and access with care proportionate to context, contract and risk.
• Respect at work: act with dignity, respect and openness to differences; abusive, discriminatory or harassing behavior is incompatible with the culture being pursued.

03 / RISK AND THIRD PARTIES

Risk requires a cycle, not a declaration.

The intended approach is proportionate to the operation, relationship and potential impact. It should only become procedures and assigned owners after appropriate validation:

1. Identify contexts, decisions and relationships more exposed to misconduct or conflicts.
2. Prevent through guidance, criteria and controls consistent with identified risk.
3. Detect signals, inconsistencies and concerns through means that are actually approved.
4. Respond through analysis, documentation and measures consistent with facts, duties and rights involved.

This cycle describes a governance direction. The audited repository does not demonstrate a formal risk-assessment, investigation, training, audit, sanction or treatment-deadline process.

Third-party relationships matter too.

Suppliers, partners and other third parties should be selected and managed in a manner consistent with law, relationship integrity and information protection. Specific requirements, checks, clauses and consequences depend on the contract, scope and policies that may be approved; this page does not claim those obligations are already standardized.

04 / QUESTIONS AND CONCERNS

Questions and concerns need an honest path.

The contact page is currently the only public institutional destination on the website. Its current form states that it does not send or store data and does not confirm receipt; therefore, it is not a verifiable technical channel for reports, complaints, investigation or tracking. The audited project does not establish a hotline, anonymity mechanism, formal non-retaliation protection or confidential channel.

Until an intake process is approved and implemented, do not send passwords, tokens, sensitive personal data, patient data, detailed allegations or confidential material through interfaces that are not validated. A future guideline should provide respectful treatment for good-faith reports and non-retaliation, without promising absolute confidentiality, an investigation, a timeline or an outcome before a formal process exists.

05 / REFERENCES AND RELATIONSHIPS

Trust, data and security in the same context.

Integrity also depends on how technology, information and responsibilities are organized. The related pages explain institutional scopes and verifiable limits; none replaces approved policies or specific contracts.

06 / UPDATES

Documented evolution, not an advance promise.

This text should be reviewed when policies, processes, channels, contracts, evidence or applicable requirements are approved. The date and version identify its current state. Any future claim about formal controls should state compatible scope and evidence.

INFORMATIONAL VERSION 0.1 · AUGUST 23, 2026