1. PRELIMINARIES

This Sub-processor List:

• forms part of the Agreement (as referenced in the Data Processing Terms);

• identifies the Sub-processors engaged by the Supplier in connection with the operation of the Platform and the provision of the Platform Services; and

• may be updated and amended by the Supplier from time to time in accordance with paragraph 3.5 of the Data Processing Terms (notification of New Sub-processors).

Defined words and phrases used in this Sub-processor List but not defined here shall have their respective meanings given in the Data Processing Terms and the Platform GTCs.

2. SUB-PROCESSORS

The following Sub-processors are engaged by the Supplier in connection with the operation of the Platform and the provision of the Platform Services:

Sub-processor	Service provided	Data categories processed	Processing location	Status
Amazon Web Services EMEA SARL (AWS)	Cloud hosting and storage; AI Model and content extraction provider via Amazon Bedrock, operated within the Supplier's virtual private connection (AWS PrivateLink) under zero-retention terms; Processing and generation of AI Outputs.	Personal data; Special category data (medical records and associated medico-legal documents); Prompts and Outputs.	eu-west-2 (London)	Active
Causal Legal Limited	Quality assurance of Outputs; Additional manual record sorting and review in support of the Platform Services.	Personal data; Special category data (medical records and associated medico-legal documents).	United Kingdom	Active
Bird.com (MessageBird B.V.)	In-platform communications (e.g. transactional notifications, magic-link delivery via SMS or email).	Personal data (name, email address, telephone number, message content limited to communications metadata).	European Economic Area	Active where utilised
Mailgun (Sinch Email)	In-platform communications (e.g. transactional email delivery, magic-link delivery via email).	Personal data (name, email address, message content limited to communications metadata).	European Union / United Kingdom region	Active where utilised

3. NOTES

• "Active" indicates a Sub-processor currently engaged by the Supplier in connection with all Customers receiving the Platform Services.

• "Active where utilised" indicates a Sub-processor engaged only in respect of specific Platform features or where the Customer's configuration requires use of that Sub-processor.

• Amazon Bedrock is operated under zero-retention terms and the underlying AI Models are not trained on the Customer's Data, as set out in paragraph 2.1.2 of the AI AUP.

• Cross-border data transfers (if any) are made in accordance with paragraph 3.9 of the Data Processing Terms and applicable Data Protection Legislation.

4. CHANGES TO THIS SUB-PROCESSOR LIST

The Supplier will notify the Customer prior to adding a New Sub-processor in accordance with paragraph 3.5 of the Data Processing Terms. The Customer's rights in respect of objections to a New Sub-processor are set out in paragraphs 3.5 to 3.8 of the Data Processing Terms.