Sub-processors

• These are our sub-processors: the companies that help us run BetterStep. This page shows what each one does for us, what it receives, and where it works. • They handle your information only on our instructions, under written contracts, and only for the job we give them. • We don't use advertisers, data brokers, or outside AI services such as ChatGPT, Claude or Gemini. We run the AI ourselves, on servers we rent. The companies we rent them from provide computing power only, and your information is never used to train AI. • If your data is stored in the United States, your account and recovery information are stored and handled in the United States. If it is stored in the EU, they stay in the EU. Section 4 lists the few exceptions. • We update this page before a new sub-processor starts receiving your information. • Questions: info@betterstep.io

BetterStep is run by better step pro LLC (Identification Number 405766620), 13 M. Tamarashvili, Tbilisi, Georgia. On this page, "BetterStep", "we" and "us" mean this company. This page goes with our Privacy Policy, our Health Data Policy (our Consumer Health Data Privacy Policy) and our Terms of Use. Those documents call it the "Sub-processors page". Those policies explain what we collect, why we collect it, and your rights. This page names the companies that help us. If this page ever seems to say something different from those policies, the policies apply. Words we use. A sub-processor is a company that handles personal information for us, only to do a job we give it. Privacy laws also call these companies "processors", "service providers" or "vendors". This page is for information. It is not a contract.

Sub-processors that store or handle your information • Hosting, database and backups, including network security: US data: Google Cloud (Google LLC, United States). EU data: Hetzner (Hetzner Online GmbH, Germany). What it receives: All the information BetterStep stores about you, including your health information. Where it works: US data: United States. EU data: Germany. • AI servers (servers we rent to run the AI model ourselves; we do not use Google's or anyone else's AI services): US data: Google Cloud (Google LLC, United States). EU data: Hetzner (Hetzner Online GmbH, Germany). What it receives: The text you write, and the parts of your profile and check-ins our AI needs to answer you. It passes through the rented servers only so our own AI can answer you. Where it works: US data: United States. EU data: Germany. • Connecting Apple Health, Health Connect, Samsung Health and wearables: Terra (Terra Enabling Developers Inc., United States). What it receives: Your body readings and connection details, only if you connect. Where it works: US data: United States. EU data: the EU. • Crash and error reports: Sentry (Functional Software, Inc., United States). What it receives: Technical details about the error, your device and app version, and your IP address. What you write is not included. Where it works: US data: United States. EU data: Germany. • Sending email: SendGrid (Twilio Inc., United States). What it receives: Your email address and the emails we send you. Where it works: US data: United States. EU data: the EU. • Our mailbox: Google Workspace (Google LLC, United States). What it receives: Messages you send to info@betterstep.io, and our replies. Where it works: United States. Services that work worldwide • Push notifications: Firebase Cloud Messaging (Google LLC, United States) and Apple Push Notification service (Apple Inc., United States). What it receives: Your device's notification token and the reminder text. Reminders never mention your recovery details. Where it works: Worldwide. • Sign in with Apple: Apple Inc. (United States). What it receives: Your sign-in details, only if you choose it. Apple learns that you use BetterStep. Where it works: Worldwide. • Sign in with Google: Google LLC (United States). What it receives: Your sign-in details, only if you choose it. Google learns that you use BetterStep. Where it works: Worldwide. Apple and Google provide these services under their own developer terms and privacy policies. When you sign in with Apple or Google, you use your own account with that company. A company that receives nothing about you • Turning the app's prepared scripts into spoken audio: ElevenLabs (Eleven Labs Inc., United States). What it receives: Only the app's own prepared scripts. Nothing about you. Where it works: United States. Their own sub-processors. Some of these companies use sub-processors of their own and publish a list of them: Google Cloud (cloud.google.com/terms/subprocessors), Google Workspace (workspace.google.com/terms/subprocessors), Sentry (sentry.io/legal/subprocessors) and Twilio (twilio.com/en-us/legal/sub-processors). Not on this list • Advertisers, advertising networks, data brokers, analytics or tracking companies, and outside AI services. We use none of them. • Your clinic. A clinic is not our sub-processor. It sees your information only if you tap Share. The Privacy Policy (section 8) and the Health Data Policy (section 6) explain what it sees. • Your app store, phone and wearable. Apple and Google run the App Store, Google Play, Apple Health and Health Connect under their own terms and privacy policies. So does the maker of your wearable. What they collect when you use their products is covered by their policies, not ours. • Payments. We don't collect payment details. If you pay through the App Store or Google Play, Apple or Google handles the payment under its own terms. If we ever take payments another way, we will add the payment company here before it receives anything.

Our written contracts require every company in the first list to: • use your information only to do the job we give it, on our instructions; • keep it confidential and protect it; • tell us without delay if it is ever breached; • make its own sub-processors follow the same rules, and stay responsible for them; • delete your information, or give it back, when we tell it to. None of them may sell your information, use it for advertising, or use it to train AI.

• If your data is stored in the United States, your account, your recovery information, what you write, your body readings, your AI processing and your backups are stored and handled in the United States. • If your data is stored in the EU, all of these are stored and handled in the EU. • The exceptions: ◦ Push notifications and sign-in with Apple or Google run on those companies' own worldwide systems. They receive only what the job needs, never your recovery information. ◦ Messages you send us by email are kept in our mailbox in the United States, wherever your data is stored. • Our team, including staff in Georgia, may view your information from outside your region to run and support BetterStep. Your information stays on the servers in your region. The Privacy Policy (section 9) explains the legal safeguards. • Which region stores your data. The app's "Where your data is stored" page shows you before you agree. It lists each type of data and where it is kept, using this same list.

• We update this page before a new sub-processor starts receiving your personal information, and we change the "Last updated" date at the top. • If a change would store or handle your data outside your region (the United States or the EU, as shown on your "Where your data is stored" page), or give your health information to a new kind of company, we will tell you and ask for your permission first. • We keep every past version of this page. Email us if you would like one.

• This page is the list of sub-processors that our clinic agreements refer to. • Before we add or replace a sub-processor that will handle your patients' information, we email your account administrator at least 30 days ahead. You can object on reasonable data protection grounds, as your agreement explains. If we must replace a sub-processor sooner to protect your patients' information, we tell you as soon as we can. • US clinics. Information your clinic gives us, and information your patients share with your clinic through BetterStep, is handled only by sub-processors that have signed a business associate agreement with us where HIPAA requires one. Records covered by 42 CFR Part 2 are handled only as that law and our Qualified Service Organization Agreement with your clinic allow. • Text messages from your own account. A clinic in Georgia can connect its own Sender.ge account to text its patients from the dashboard. Those messages, including each patient's phone number, go through the clinic's own account, under the clinic's own agreement with Sender.ge. Sender.ge is not our sub-processor. • Your staff's own dashboard accounts are covered by the clinic dashboard's privacy notice.