Subprocessor List

1. Overview

Rymeda, Inc. engages the following third-party subprocessors to assist in providing services to our customers. This list is maintained pursuant to the Data Processing Agreement and the Business Associate Agreement.

Each subprocessor is contractually bound to data protection obligations no less protective than those in our DPA and, where applicable, has executed a BAA for the handling of Protected Health Information ("PHI"). For details on how we manage subprocessor relationships, see Section 5 of the DPA and Section 8 of the BAA.

2. Infrastructure Subprocessors

These subprocessors provide core infrastructure services including hosting, compute, storage, and networking.

3. Application Subprocessors

These subprocessors provide application-level services including email, analytics, and customer support.

4. AI and Machine Learning Subprocessors

These subprocessors provide AI and machine learning capabilities. PHI is processed through our redaction pipeline before reaching these services, as described on our Security page.

5. Notification of Changes

Rymeda provides thirty (30) days' advance written notice before engaging a new subprocessor or materially changing an existing subprocessor's scope, as specified in Section 5 of the Data Processing Agreement. Notifications are sent to the email address associated with the customer's account.

Customers may object to a new subprocessor within fifteen (15) days of notification. If the objection cannot be resolved, either party may terminate the affected services.

6. Contact

For questions about our subprocessors or to subscribe to subprocessor change notifications:

• Privacy Office: privacy@rymeda.com
• Compliance Office: compliance@rymeda.com