Privacy and Personal Data Protection Policy

Makana SpA

Privacy at a glance

Contents

1. About this Policy and its scope

2. Data controller and contact channels

3. Principles we apply

4. Roles of Makana, Contracting Companies and Partners

5. Data we process and how we obtain it

6. Sensitive data and categories with reinforced protection

7. Purposes, legitimation and lawful bases

8. Consents and User control

9. Alma, artificial intelligence and automated decisions

10. Corporate visibility and prohibition of workplace surveillance

11. Recipients, processors and independent third parties

12. International transfers

13. Retention, deletion and anonymization

14. Security and incidents

15. Rights and how to exercise them

16. Data of children and adolescents

17. Cookies, SDKs and local storage

18. Changes to the Policy

19. Questions and complaints

1. ABOUT THIS POLICY AND ITS SCOPE

This Policy explains how Makana SpA (“Makana”, “we” or “our”) processes the personal data of individuals who create an account, use our services, visit our sites, take part in communities or events, use physical equipment and spaces, purchase a subscription, communicate with us or are beneficiaries of a corporate program (the “Users”).

The Policy applies to the makana.cl website, the Makana mobile apps, Makana Corner and other associated spaces or equipment, the digital modules and the available integrations, including Alma and the Makana MCP Connector. It also applies to anyone who contacts Makana for support, sales, partnerships, events or implementation processes.

This Policy complements the Terms and Conditions of Use. Some modules present specific privacy notices before they are activated. Where a specific notice provides more detailed information about a particular processing activity, it applies together with this Policy. The Supplemental Terms of the Makana MCP Connector prevail on the matters specific to that connector.

Makana provides services in both B2B and B2C models. The fact that a company, insurer, broker, benefits administrator or Partner funds or facilitates access does not mean it can access all the information in the account.

2. DATA CONTROLLER AND CONTACT CHANNELS

Data controller: Makana SpA, RUT N° 77.601.505-9.

Legal representative: Kai Horwitz Von Appen.

Registered address: Antonio Bellet 193, oficina 302, tercer piso, comuna de Providencia, Región Metropolitana, Chile.

Channel for privacy matters and the exercise of rights: privacidad@makana.cl.

General support channel: hola@makana.cl.

Makana acts as data controller when it determines the purposes and means to operate the account, provide modules directly to the User, maintain security, manage subscriptions, personalize the experience and handle requests. In specific B2B operations, Makana may act as a data processor only where there is a documented instruction, lawful directions and an effective separation of purposes.

3. PRINCIPLES WE APPLY TO PROCESSING

The following principles guide the processing of personal data carried out by Makana:

a) Lawfulness and fairness: Makana will process your personal data only with your consent or where the regulations expressly allow it.

b) Purpose: with your consent, we collect data for specified, explicit and legitimate purposes and we do not reuse it for incompatible purposes without a new legal ground.

c) Proportionality: we limit processing to data that is adequate, relevant and necessary to carry out the purposes we have informed, keeping it for the time required to fulfill those purposes.

d) Quality: Makana, as data controller, will take reasonable measures to ensure that the information is complete, accurate, up to date and relevant.

e) Accountability: we maintain policies, records and controls that allow us to demonstrate compliance.

f) Security: we apply technical and organizational measures appropriate to the nature of the data and the risks involved, in compliance with the regulations in force.

g) Transparency: we provide clear and accessible information and make it easy to exercise rights.

h) Confidentiality: we limit access to authorized staff and suppliers bound by duties of confidentiality.

4. ROLES OF MAKANA, CONTRACTING COMPANIES AND PARTNERS

Under a B2B model, a company or organization may contract access for workers, employees or beneficiaries (the “Contracting Company”). A broker, insurer, benefits administrator, distributor or other intermediary may facilitate access (the “Partner”).

The Contracting Company may share with Makana the minimum administrative information needed to enable or end a benefit, such as name, email, company, department, employee identifier and eligibility status. Each entity is responsible for its own administrative, employment or commercial operations.

The Contracting Company and the Partner may not accept, on the User's behalf, consents relating to sensitive data, bank connections, private conversations, personal documents, marketing, precise geolocation or any other processing that requires a personal decision.

A deactivation requested by a Contracting Company or Partner only affects the corporate link it administers. It does not authorize access to, transfer of or deletion of private modules, nor does it cancel an independent B2C subscription.

5. DATA WE PROCESS AND HOW WE OBTAIN IT

We may obtain data from the following sources:

a) Directly from the User, when they create an account, fill out forms, talk to Alma, upload documents, log meals, activity, finances or wellbeing, post content or contact support;

b) From the device and from use of the Platform, through technical logs, analytics, cookies, SDKs, sensors or permissions the User enables;

c) From the Contracting Company or Partner, only for eligibility and administration of the benefit;

d) From banks, financial connection providers, wearables, health repositories, Google, Apple or other services connected by the User;

e) From app stores, payment processors, identity providers and reward issuers;

f) From Makana's models and rules, which generate inferences, recommendations or classifications from the available information.

When the User connects a device, an app or a health repository, Makana accesses only the categories of information necessary for the functions disclosed at the time of connection, and always on a read-only basis. In the case of the Google Health API and Health Connect, that information covers physical activity and workouts, sleep and its stages, heart rate and its variability, and body and vital sign measurements. In the case of Apple Health, the information comes from the health repository on the device itself. Makana does not access contacts, email, calendar, files or any other category of information in the User's account with those providers.

Makana's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, that information will not be used for advertising or commercial profiling purposes, will not be sold or assigned to third parties, will not be read by humans unless the User expressly authorizes it, it is necessary for security reasons, there is a legal obligation or the data is aggregated and anonymized, and it will not be used to train general artificial intelligence models, whether our own or third parties', as stated in section 9.

The User may disconnect the device, app or repository from the Platform at any time, and may also revoke the access granted in their account with the relevant provider. Disconnecting stops the collection of new data and operates in line with the withdrawal of consent described in section 8.

Certain data, such as the local mood history, may remain only on the device and never be sent to Makana, unless the User chooses to use it as context in a specific feature.

Generally speaking, the commercial relationship with the relevant data subject is one of the main sources from which personal data is obtained, especially when contracting or requesting information about a product or service. This relationship may be established through various channels, whether in person or remotely, such as accessing, visiting or using online apps and services, websites, forms, emails, mobile phones, text messages, WhatsApp or any similar electronic means.

6. SENSITIVE DATA AND CATEGORIES WITH REINFORCED PROTECTION

Makana processes information that may reveal physical or mental health, socioeconomic situation, biometrics or biological profile and, potentially, other circumstances of private life. This data receives reinforced protection.

Where processing is based on consent, we will ask for express, specific, informed and separate authorization for the relevant category or module. General acceptance of the Terms does not replace this consent.

Data relating to health and biological profile will be processed only where the law allows it. Makana will not use consent to circumvent a special legal prohibition applicable to data collected in employment, education, sports, social, insurance, security or identification settings. If an operation falls within a prohibition of this kind, it will be suspended, limited or redesigned unless there is an express and applicable legal authorization.

Financial, banking and socioeconomic information is protected with reinforced controls. The Connector and the financial features do not allow payments or transfers to be initiated, nor do they allow access to passwords or second-factor mechanisms, unless a future feature discloses this and has an independent legal ground.

7. PURPOSES, LEGITIMATION AND LAWFUL BASES

Makana will process personal data only where there is a sufficient legal basis and it can demonstrate its application. The basis used will depend on the purpose, the category of data and the existing relationship with the User. Entering into the general agreement or accepting the Terms and Conditions does not replace the specific consents required for sensitive data or optional features.

Consent. For optional modules, sensitive data, health, wellbeing, nutrition, financial connections, wearables, marketing, precise geolocation and connections with external assistants, where applicable.

Performance of a contract or pre-contractual measures. To create and manage accounts, provide requested features, and manage subscriptions, payments and support.

Legal obligations. For tax, accounting, regulatory, judicial, security or consumer protection obligations.

Legitimate interest. For security, fraud prevention, support, technical improvement or defense of the platform, provided that Makana assesses the necessity and the User's rights do not override it.

Exercise or defense of rights. To keep records related to claims, investigations, litigation or administrative proceedings.

Other legal grounds. Where a sector-specific rule permits or requires a particular processing activity.

For sensitive data it is not enough to state generically that there is “performance of a contract” or “legitimate interest”. The specific applicable rule must be identified and, where relevant, express, separate and informed consent must be obtained.

Where we rely on a legitimate interest, we will assess the necessity of the processing, its impact on the User's rights and the safeguards in place. The User may request information about the interest relied upon and may object where the law allows it.

8. CONSENTS AND USER CONTROL

Consents are presented with clear information and an affirmative action. Boxes must not be pre-ticked. Activating one module does not condition the activation of others, unless a technical dependency is essential and is explained beforehand.

Makana may ask for independent decisions on:

a) health and wellbeing data;

b) mental health, conversations and Alma's memories;

c) nutrition and photo analysis;

d) bank connections and processing of financial information;

e) data from wearables and health repositories;

f) processing of voice, images or documents by artificial intelligence providers;

g) precise geolocation;

h) commercial communications;

i) connections with external assistants and each data domain of the Makana MCP Connector;

j) any secondary use that is not compatible with the purpose disclosed.

The User may withdraw each consent free of charge through the module's settings, the Privacy Center or by writing to privacidad@makana.cl. Withdrawal does not affect the lawfulness of processing carried out before it and may prevent the continuity of the feature directly associated with it, without removing unrelated features.

Makana keeps reasonable evidence of the information presented, the affirmative action, the date, time, version, purpose, authorized categories and withdrawal.

9. ALMA, ARTIFICIAL INTELLIGENCE AND AUTOMATED DECISIONS

Makana uses its own and third-party artificial intelligence systems for conversation, search, classification, document structuring, food analysis, training suggestions, financial categorization, coverage extraction and similar functions.

Alma may use the context the User enables and memories of preferences or goals. The User may review, correct, limit or delete these memories where the feature allows it, and may always request the exercise of their rights.

These systems may produce inaccurate, incomplete or inappropriate results. Makana does not use Alma to diagnose, prescribe medication, replace professional care, execute financial decisions or make employment decisions. Faced with a possible crisis situation, the system may display help resources, limit certain responses or trigger internal safety mechanisms; this does not guarantee detection and does not imply reporting the situation to the employer or Partner.

Makana will not make decisions based solely on automated processing that produce legal effects or significantly affect the User, unless there is an applicable legal ground and the required safeguards are in place. In those cases, the User may obtain meaningful information about the logic and consequences, request an explanation, human intervention, express their point of view, correct input data and request a review.

Identifiable or sensitive content from conversations, documents, images, audio and records will not be used to train general models, whether our own or third parties'. Evaluation and improvement will be carried out preferably with technical metrics, feedback and effectively anonymized data. A different use would require a separate legal basis and, where applicable, specific consent.

10. CORPORATE VISIBILITY AND PROHIBITION OF WORKPLACE SURVEILLANCE

In B2B programs, the corporate portal is limited to managing eligibility, activations and deactivations, coordinating resources, handling support and viewing operational metrics or anonymous or aggregated statistics.

The Contracting Company or Partner does not receive general access to:

a) pain, fatigue, stress, mood or individual assessments;

b) Alma conversations, audio, memories or alerts;

c) nutrition, physical health, training or wearable data;

d) accounts, balances, transactions, budgets or financial information;

e) policies, plans or coverage documents;

f) content from an independent B2C subscription.

The portal may display strictly administrative identified data, such as name, company, department, activation status and account support. Identified bookings or attendance may only be displayed where they are essential for capacity, physical access, security or availability, without including routine, equipment, reason or health inferences.

Group reports will use aggregation, suppression, grouping, rounding and query control measures. A numerical threshold does not by itself make information anonymous; Makana will not display reports where the context, filters or cross-referencing would reasonably allow a person to be identified.

It is prohibited to use information from Makana for covert surveillance, discrimination, retaliation, sanctions, termination of employment, recruitment, insurance, productivity, performance evaluation or re-identification of reports.

11. RECIPIENTS, PROCESSORS AND INDEPENDENT THIRD PARTIES

Makana may use providers of infrastructure, hosting, storage, authentication, messaging, analytics, support, artificial intelligence, voice, document processing, security, payments, subscriptions, rewards, maps and wearables.

Where a provider acts on Makana's behalf, it must process the data in accordance with documented instructions and a contract governing subject matter, duration, purposes, categories of data and data subjects, confidentiality, security, sub-processors, assistance with rights, incidents, audits and return or deletion.

Some third parties act as independent controllers, for example app stores, processors acting as merchant of record, banks, card issuers or services the User connects under their own terms. In those cases, their processing is also governed by their own policies.

Makana maintains a Register of Providers, Processors, Independent Controllers and International Transfers in the Legal section of makana.cl. It states, as applicable, the entity, service, data, purpose, location, role, retention and use of information for model training.

We may also disclose data to authorities, courts, regulators or advisers where there is a legal obligation, a valid order, or where it is necessary to establish, exercise or defend rights. We will limit the information to what is strictly necessary.

12. INTERNATIONAL TRANSFERS

Some providers process or store data in the United States, Europe or other countries. Makana identifies the relevant destinations in its public register and keeps documentation of the transfers.

Transfers will be carried out using the bases permitted by the regulations, such as adequacy decisions, contractual clauses or other instruments with appropriate safeguards, binding corporate rules, certification mechanisms, performance of a contract or specific legal authorizations, as applicable. Consent will be used only in those cases where it constitutes a valid ground for the specific transfer.

We apply complementary measures such as minimization, encryption, tokenization, segregation, access control and provider assessment. The User may request additional information about the safeguards, except for records that must remain confidential for legitimate security reasons.

When the User connects an external assistant through the Makana MCP Connector, they authorize a disclosure by data domain to the selected provider. Once received, that provider may process the data in accordance with its own terms, settings and privacy policy. Makana discloses this before the connection and allows the credential to be revoked, but it does not control copies that the external provider may have legitimately kept before revocation.

13. RETENTION, DELETION AND ANONYMIZATION

Makana will retain personal data for as long as necessary to fulfill the purpose for which it was obtained. The period will depend on the module used, whether the account is active, the User's decisions, the applicable legal obligations and the technical deletion and backup cycles. Where data is no longer necessary, it will be deleted, anonymized or, where there is a retention obligation, blocked and kept with restricted access.

We keep data only for as long as it is necessary to provide the module, fulfill the disclosed purpose, maintain security, meet legal obligations or defend rights. The periods depend on the category, the status of the account, the User's settings and the providers' backup cycles.

When an account is closed, Makana deactivates access and deletes or anonymizes the data in accordance with the retention table. It may keep limited information where it is necessary for legal obligations, billing, fraud prevention, security, evidence of consents, the exercise of rights or the defense of claims.

Cancelling a subscription, ending a corporate benefit and deleting an account are separate actions. Closure may cause the irreversible loss of records, progress, content, points and settings; where an export feature exists, this will be disclosed before confirming.

We consider data anonymous only where it is not reasonably possible to link it to a person, taking into account the means, cross-referencing and context involved. Pseudonymization, an internal identifier or a minimum threshold do not by themselves remove the personal character of the data.

14. SECURITY AND INCIDENTS

Makana applies technical and organizational measures appropriate to the risk, including, depending on the system and the sensitivity of the data: role-based access control, authentication, encryption in transit and of selected fields at rest, key management, tokenization, service segregation, audit logs, monitoring, backups, vulnerability management, secure development, testing and training.

We periodically review confidentiality, integrity, availability, resilience and the ability to restore. No system is completely secure; these measures are not a guarantee of invulnerability.

Makana maintains a procedure for detecting, containing, investigating, recording and notifying incidents. Where a breach creates a reasonable risk to rights and freedoms, we will inform the competent authority without undue delay from the moment the obligation becomes applicable. Where appropriate given the nature of the data or the risk, we will also inform the affected individuals in plain language, describing the categories involved, the possible consequences and the protective measures.

The User must protect their device and credentials, use lock mechanisms, keep the app updated and immediately report any unauthorized access to hola@makana.cl or .

15. RIGHTS AND HOW TO EXERCISE THEM

The User may exercise the following rights, in the cases and under the conditions provided by law:

a) Right to request access: confirm whether we process data, learn its origin, purposes, recipients and retention, and obtain a copy.

b) Right to request rectification: correct inaccurate, outdated or incomplete data.

c) Right to deletion: request the removal of data where it is no longer necessary, where consent is withdrawn and there is no other basis, where the processing is unlawful, where the data has expired or where another legal ground applies.

d) Right to object: request that processing based on legitimate interest, direct marketing or other legal grounds be stopped.

e) Right to portability: receive certain data provided to Makana in a structured format and request its transmission where technically feasible.

f) Right to blocking: request the temporary suspension of processing while a rectification, deletion or objection request is resolved, or in the other cases provided by law.

g) Right to withdraw consent: revoke specific authorizations, without retroactive effect.

h) Right regarding automated decisions: object to significant decisions, obtain an explanation, human intervention, express a point of view and request a review.

To exercise them, the User may use the Privacy Center in the app or send a request to privacidad@makana.cl. The request must identify the data subject, state a means of reply and describe the right or processing involved. We will ask only for the information needed to verify identity in a proportionate and secure way.

Makana will acknowledge receipt and reply within the legal deadline. From December 1, 2026, the general deadline will be thirty calendar days, extendable once by up to another thirty calendar days. A well-founded request for temporary blocking associated with rectification, deletion or objection will be resolved within two business days. Refusals will be reasoned and will state the avenue for complaint.

Exercising these rights is free of charge, except where the law expressly allows otherwise. Where we have disclosed data to third parties, we will inform them of rectifications, deletions or objections where appropriate and reasonably possible.

16. DATA OF CHILDREN AND ADOLESCENTS

The Platform is intended for people aged eighteen or over, and the physical recovery equipment may only be used by adults. Makana does not seek to deliberately register minors.

If we detect that an account was created by a minor without the flow, authorization and measures legally required, we may suspend it and delete or block the information. Any future experience for minors must be designed through a special flow, with age-appropriate information, respect for their best interests and progressive autonomy, and the consent of their legal representative where applicable.

17. COOKIES, SDKs AND LOCAL STORAGE

The site and the apps may use cookies, SDKs, local storage and similar technologies for authentication, security, preferences, operation, analytics, stability, notifications and, where the User authorizes it, marketing.

Technologies necessary to operate and protect the service may remain active. Those for non-essential analytics, personalization or marketing are managed through consent options where applicable. The User may change their preferences in the available manager, the browser, the operating system or the app settings.

The Cookies and Tracking Technologies Policy identifies providers, purposes, duration and control options. Some data saved locally on the device may be lost when the app is deleted, the device is changed or storage is cleared.

18. CHANGES TO THE POLICY

Makana may update this Policy to reflect legal, regulatory, technical or service changes. We will publish the version in force with its date and keep a reasonable version history.

Where a change is material, we will communicate it through the app, by email or another suitable means before it takes effect, whenever this is reasonably possible. If the new processing requires consent, we will not begin it until a valid affirmative action is obtained. Mere publication does not replace a consent required by law.

19. QUESTIONS AND COMPLAINTS

Questions, requests and complaints about privacy may be sent to privacidad@makana.cl. For operational matters or support, you may also use .

Likewise, at Makana we make every effort to comply with data protection regulations, as this is the most valuable asset we hold. That said, please note that if you believe your rights have been impaired, you may file a complaint with our Data Protection Officer (DPO), [INDICAR DELEGADO], at [*] or with the relevant data protection authority.