Supplemental Terms and Conditions for the Artificial Intelligence Assistant Connector (“Makana MCP Connector”)

1. Nature and relationship with the General Terms

1.1. Purpose

These Supplemental Terms and Conditions (the “Connector Terms”) govern the enabling and use of the Makana MCP Connector (the “Connector”), a feature that lets the User authorize an external artificial intelligence assistant of their choice to access, on the User's own instruction, certain information from their account on the Platform.

These Connector Terms supplement MAKANA's Terms and Conditions and Privacy Policy (the “General Terms”) and prevail over them only on matters specific to the Connector. On anything not governed here, the General Terms apply. Use of the Connector is a function expressly enabled by MAKANA for the purposes of the cybersecurity and authorized use clause of the General Terms.

1.2. Acceptance

The Connector is activated only through an affirmative and unambiguous action by the User within the connection flow, after being given the chance to review, download, store or print these Connector Terms. Acceptance will not be inferred from silence, from merely visiting a page or from inactivity. MAKANA will keep evidence of the acceptance, including date, time, version accepted and technical records, without preventing the User from disputing its accuracy.

Accepting these Connector Terms does not replace the specific consents per data category described in clause 3, which will be requested separately, granularly and revocably.

2. Description of the Connector

2.1. How it works

The Connector is a server that implements the open Model Context Protocol (“MCP”), a standard that lets artificial intelligence assistants query data sources authorized by their users. Once enabled, the assistant chosen by the User — for example Claude, by Anthropic, or another compatible assistant that MAKANA discloses — may request information from the User's account and, where the User authorizes it, record information in it, always within the data domains the User has consented to.

Requests are made from the assistant provider's infrastructure to MAKANA's servers. The Connector operates only on the authenticated User's account and does not allow access to information of other users, of the Contracting Company or of third parties.

2.2. Read-only as the general rule

Most Connector functions are read-only. Functions that record or modify information are identified as write operations and are subject to clause 6. The Connector never allows payments, transfers or other dispositive operations on financial products to be initiated, nor access to the User's banking credentials, passwords or second-factor mechanisms.

3. Enabling the Connector and consents by data domain

3.1. Authentication

Enabling the Connector requires the User to authenticate with their MAKANA account through a secure authorization flow. The external assistant receives a limited credential, tied exclusively to the consented domains, which does not include the User's password and which can be revoked at any time.

3.2. Granular, separate consent

Before completing the connection, MAKANA will ask the User for independent, specific, prior and unambiguous consents for each data domain they wish to expose to the assistant. No domain is pre-selected, and enabling one domain does not condition the others. The available domains are:

a) Personal finances: financial summaries, imported movements and transactions, connected accounts and balances, budgets, categories, detected subscriptions and financial profile. This information reflects the User's socioeconomic situation and receives the reinforced standard applicable to sensitive data under Chilean law.

b) Mental health and wellbeing: conversations with Alma, content recommendations and wellbeing protocols, and the memories the Platform keeps in order to personalize the User's experience.

c) Physical health, training and devices: training profile, including injuries or conditions reported by the User, routines, programs, workout records and, if the User has connected a measurement device or service, physiological data such as sleep, recovery, heart rate variability and activity.

d) Nutrition: meal logs, meal plan, restrictions and preferences, and nutritional summaries.

MAKANA will keep evidence of each consent, including the information provided, the affirmative action, the version of the text, the purpose and, where applicable, the withdrawal. Health data and financial information will be exposed to the assistant only by virtue of express consent for the relevant domain.

3.3. Subscription and availability

Availability of the Connector may depend on the User's plan, country and technical setup. MAKANA will disclose these requirements before the connection.

4. Information exposed and minimization

MAKANA will apply minimization measures so that the Connector provides the information needed to answer each request from the assistant. Before exposing financial text, MAKANA will apply tokenization mechanisms intended to replace identifiers such as RUT, names, account numbers, phone numbers and emails, as stated in the General Terms. The Connector does not expose banking credentials, passwords, the finance PIN or identity documents.

No measure removes the risk entirely. The User should bear in mind that the questions they put to their assistant, and the answers it generates, may incorporate sensitive information from the consented domains.

5. Role of the assistant's provider

5.1. Processing on the User's behalf

The provider of the artificial intelligence assistant the User connects acts by the User's own choice and instruction, within the direct contractual relationship between the User and that provider. Accordingly, that provider does not act as MAKANA's data processor with respect to the information the User decides to channel through the Connector, and its subsequent processing is governed by the terms, privacy policies and account settings the User holds with that provider.

5.2. Retention and use by the provider

Once the information is handed to the assistant, MAKANA does not control its retention, use or deletion. Retention periods and model-training options depend on the plan and settings the User keeps with their provider. As of this version, Anthropic states that content brought in through MCP connectors is not used to train its models, unless the user manually copies it into the conversation, and that retention in consumer accounts may extend to long periods depending on each account's settings. The User should review and configure their assistant's privacy options before connecting.

5.3. The User's duty of care

The User is responsible for connecting only assistants and accounts under their control, for safeguarding access to those accounts and for disconnecting the Connector at any suspicion of unauthorized use. The User may consult the up-to-date list of providers and transfer mechanisms at https://www.makana.cl/en/legal.

6. Write operations

Certain Connector functions let the assistant record or modify information in the User's account — for example categorizing a transaction, logging a meal, creating a routine or completing a workout. These functions are identified as write operations, and the assistant is instructed to ask for the User's confirmation before running them. The User should review the actions their assistant proposes, since artificial intelligence models may produce inaccurate, incomplete or inappropriate results. Write operations do not cover payments, transfers, or the purchase or modification of financial products.

7. International transfers

Using the Connector means that the information in the consented domains is disclosed to the assistant provider's infrastructure, which may be located in the United States or other countries. MAKANA will disclose the relevant destinations and apply the corresponding legal mechanism in accordance with the General Terms and the regulations in force. The User acknowledges that the disclosure to the assistant takes place on their own instruction and to a recipient of their own choosing.

8. Revocation and disconnection

The User may revoke each domain consent or fully disconnect the Connector at any time, free of charge and by prompt means, from the Platform or by removing the connection in their assistant. Once the disconnection or the revocation of a domain is complete, the assistant cannot start new requests for the affected information. Revocation has no retroactive effect: information already handed to the assistant remains subject to the provider's terms and to the deletion tools that provider offers the User. MAKANA will keep the evidence of consents and revocations as a record of compliance with its obligations.

9. Security

MAKANA applies to the Connector authentication and authorization controls, credential validation on every request, per-user isolation, logging of the operations carried out, and the other security measures described in the General Terms. Security testing of the Connector is governed by the cybersecurity and authorized use clause of the General Terms.

10. Service limits and liability

The Connector makes information available to the assistant chosen by the User, but the assistant's answers, interpretations, recommendations and actions are generated by the external provider and are not services, advice or statements from MAKANA. The limits of the respective modules described in the General Terms apply to use of the Connector, including that the information available does not constitute a diagnosis, a prescription, or financial, pension, tax or investment advice.

MAKANA may suspend or discontinue the Connector, generally or with respect to a specific provider, where there are reasonable doubts about legality, security or authorization, or where technical or regulatory changes require it, informing the User whenever possible.

11. Amendments and version in force

MAKANA may amend these Connector Terms in accordance with the amendment mechanism of the General Terms. Changes that broaden the data domains exposed, add new categories of sensitive information or substantially alter where the data goes will require a new acceptance or a new consent, as applicable. The version in force will always be available at https://www.makana.cl/en/legal, with its date indicated.