SUB-PROCESSOR REGISTER

Hunch — operated by CMA Solutions LLP

Document Reference: HUN-LEG-SPR-V3.0 Version: 3.0 (Draft for attorney review) Effective Date: [TO BE INSERTED] Last Updated: [TO BE INSERTED] Published at: use-hunch.com/legal/sub-processors

NOTICE — LIVE DOCUMENT. This Sub-Processor Register is a living document. It is updated whenever a Sub-Processor is added, removed, or materially changed. Users will be notified by message of any material change no less than fifteen (15) days before the change takes effect. Material changes that affect the scope of cross-border transfer may require fresh consent under the DPDP Act.

DRAFT INSTRUMENT. For counsel review before initial publication.

1. PURPOSE

1.1 This Sub-Processor Register ("Register") identifies all third-party processors and sub-processors engaged by CMA Solutions LLP ("Company") in connection with the conversational AI service marketed as "Hunch" (the "Service"), in compliance with Section 8(4) and Section 16 of the Digital Personal Data Protection Act, 2023, and the transparency obligations of Rule 5 of the SPDI Rules, 2011.

1.2 This Register is a Constituent Document under the Terms of Service (HUN-LEG-TOS-V3.0) and operates together with the Privacy Policy (HUN-LEG-PP-V3.0).

2. CATEGORIES OF SUB-PROCESSORS

2.1 The Company engages Sub-Processors across the following categories:

(a) Messaging-platform Sub-Processors — for delivery of conversational messages to and from Users;

(b) AI routing Sub-Processor — for routing Conversation Data to Underlying LLM Providers;

(c) Underlying LLM Providers — for generation of AI Output from Conversation Data;

(d) Payment Sub-Processor — for processing of payment transactions;

(e) Cloud-infrastructure Sub-Processors — for hosting and storage of data;

(f) Operational Sub-Processors — for ancillary services (analytics, monitoring, support, email).

3. CURRENT SUB-PROCESSOR REGISTER

The following table is illustrative and shall be confirmed and completed by the Engineering team prior to first publication. Each entry is subject to engineering confirmation marked "pending verification" where applicable.

3.1 Messaging-platform Sub-Processors

3.2 AI routing Sub-Processor

3.3 Underlying LLM Providers

The Service may, through Open Router, route Conversation Data to any of the following Underlying LLM Providers:

The Company shall, upon material change to this list (including the addition of a Provider in a new jurisdiction), notify Users by message no less than fifteen (15) days in advance.

3.4 Payment Sub-Processor

3.5 Cloud-infrastructure Sub-Processors

3.6 Operational Sub-Processors

4. PROFESSIONALS (VERSION 2)

4.1 In Version 2 of the Service, Professionals registered with the Rehabilitation Council of India ("Professionals") receive certain User data upon Layer 4 Consent. Professionals are not engaged as Sub-Processors in the general sense, but as independent practitioners. The relationship is governed by:

(a) the Therapist Handoff Consent and Protocol (HUN-LEG-THP-V3.0); (b) a Data Processing Agreement executed between the Company and each Professional (HUN-LEG-DPA-PROF-V3.0); (c) a Professional Platform Agreement.

4.2 The names of currently onboarded Professionals shall be displayed in the Service's directory; a list shall not be published in this Register save by reference.

5. CROSS-BORDER TRANSFER

5.1 Conversation Data routed by Open Router to Underlying LLM Providers (Clauses 3.2 and 3.3) may cross national borders. The Company complies with Section 16 of the DPDP Act through:

(a) the User's specific and informed Layer 1 Consent; (b) contractual safeguards with each Sub-Processor; (c) ongoing monitoring of notifications, if any, issued by the Central Government restricting transfers under Section 16(1) of the DPDP Act; (d) the Company's commitment to suspend transfers to any jurisdiction so restricted within the timelines mandated by the relevant notification.

5.2 No transfer to embargoed countries. The Company shall not knowingly route Conversation Data to a jurisdiction in respect of which the Government of India has issued a transfer restriction under the DPDP Act.

6. SUB-PROCESSOR ONBOARDING AND DUE DILIGENCE

6.1 Before engaging any new Sub-Processor, the Company shall undertake:

(a) a security questionnaire reviewing the Sub-Processor's security posture, certifications, and incident history; (b) review of the Sub-Processor's data-protection terms; (c) where applicable, execution of a Data Processing Agreement; (d) where the Sub-Processor processes Personal Data outside India, review of the jurisdiction's regulatory regime and any restrictions notified under Section 16(1) of the DPDP Act.

6.2 Material changes to the Sub-Processor list shall be: (a) approved by the Designated Partners or, where appointed, the independent Data Protection Officer; (b) recorded in the Sub-Processor Register; (c) notified to Users at least fifteen (15) days in advance; (d) where the change materially modifies the scope of cross-border transfer or processing purposes, subject to fresh Layer 1 Consent.

7. USER OBJECTION TO A SUB-PROCESSOR

7.1 A User may object to the engagement of a specific Sub-Processor by emailing support@use-hunch.com with subject line "SUB-PROCESSOR OBJECTION". The Company shall:

(a) acknowledge the objection within forty-eight (48) hours; (b) where technically and commercially feasible, accommodate the objection by routing the User's Conversation Data away from the specified Sub-Processor; (c) where accommodation is not feasible, inform the User and provide the option to withdraw Layer 1 Consent and discontinue use of the Service.

8. GRIEVANCES

8.1 Grievances relating to a Sub-Processor's data handling may be raised under the Grievance Redressal Policy (HUN-LEG-GRP-V3.0).

8.2 Where a User suspects unauthorised processing by a Sub-Processor, the User may also approach the Data Protection Board of India (upon operationalisation) under Section 27 of the DPDP Act, and the Cyber Crime Reporting Portal.

9. AMENDMENTS

9.1 The Company updates this Register on a continuing basis. Each material change is timestamped in the Revision History below.

10. CONTACT

CMA Solutions LLP LLPIN: ACP-6029 Email: support@use-hunch.com Telephone: +91 9667674105.

SCHEDULE 1 — REVISION HISTORY

Future entries shall record additions, removals, and material changes to the Sub-Processor list.

END OF SUB-PROCESSOR REGISTER.

Draft for attorney review. Not legal advice. Engineering verification required prior to publication.