Privacy Policy

Lacata Benefits is designed to handle as little personal information as possible. We do not store images of your insurance card, and we do not read names, dates of birth, or addresses off it. We only keep what we need to give you a coverage summary and (if you opt in) to connect you with your lactation provider — which, if you choose to be contacted, includes a few details your insurer requires before it will confirm coverage. Those you give us directly, and you can skip them.

Information from your insurance card (ephemeral): When you upload a card image, we send it to a third-party AI service (Anthropic) to read the carrier name, plan type, member ID, group ID, member services phone number, and the employer or plan sponsor named on the card — an organization, not a person, and only because coverage for lactation visits frequently differs between employers on the same insurance plan. The image is held in memory for the length of the request and is never written to disk. We deliberately do not extract names, dates of birth, or addresses.

Of what we read, only the carrier name and plan type are stored. Your member ID and group ID are never written to our database, and neither is the employer name — we keep only a reference to the matching entry in our own coverage records. If — and only if — you choose to send your details to a provider, they are included in that one email so the provider can verify your benefits with your insurer. If you do not contact a provider, they are discarded when you close the page.

Information from the chat: Your follow-up questions and our responses are processed by an AI service to answer you. Chat messages are not persisted to our database. We do record which category a question fell into — for example "breast pump coverage" or "referral requirements" — together with the carrier and plan type, so we can see which topics our knowledge base answers poorly. That record contains no message text and is not linked to you or to your coverage results.

Information you provide: If you choose to contact a provider through the widget, we collect your name, email, phone, and home address, which the practice needs to register you as a patient. We then ask for the details an insurer requires to verify lactation benefits: your date of birth, your baby's first and last name, and your baby's date of birth (or due date). We also ask whether the plan is in your name. If it belongs to someone else — a spouse or a parent, and for your baby's own plan often the father — we ask for that person's name and date of birth and how you are related to them, because an insurer will not discuss a policy without them. Those subscriber details are passed straight to the practice in that one email and are never saved on our servers. Every field on that step is optional and can be skipped — your request is still sent. You can also add a note for the practice in your own words; it is optional, encrypted while we hold it, and shared only with the practice. All of it is shared with the practice you select, and nothing else.

If you upload a separate card for your baby, we also store the carrier name and plan type from it, because lactation visits are billed for you and your baby as two separate patients.

How the widget is used: We record which step of the widget was reached — opened, card submitted, results shown, consultation requested — so providers can see where people get stuck. Each visit gets a random identifier that is discarded when you close the tab. These records contain no personal data and are not linked to you, to your coverage results, or to each other across visits.

Technical information: We collect basic technical information like browser type and IP address for security and analytics purposes.

The provider you chose: If you submit your contact information, the practice (e.g., your lactation consultant) will receive your name, email, phone, home address, any note you wrote, your coverage summary, any verification details you chose to give (your date of birth, your baby's name and date of birth, and the name, date of birth and relationship of whoever holds the plan when that is not you), and the carrier, plan and member ID read from your card so they can verify your benefits with your insurer.

A copy of your card photo is attached to that email, because your provider has to see the card itself to confirm coverage with your insurer. It is passed straight through to them and is still never saved on our servers. Nothing is sent to any provider unless you choose to contact one.

Service providers: We use third-party services to operate the Service. Each is bound by its own terms of service and data protection commitments:

• Anthropic (AI coverage analysis)
• Railway (application and database hosting)
• Resend (email delivery)
• Google Workspace (calendar integration, where a practice connects one)

We are working toward Business Associate Agreements with these vendors. Those agreements are not yet in place.
We do not sell your information. We do not share your data with advertisers or data brokers.

Lacata Benefits is not a healthcare provider and is not a covered entity under HIPAA. We are an informational tool that helps you understand what your insurance plan is likely to cover.

We build with privacy-protective defaults:

• Minimum necessary data collection — no names, dates of birth, or addresses are read from your card, and the details an insurer needs are asked for directly and are optional
• Card images are never written to disk
• Member ID and group ID are never saved, and leave the Service only in an email you choose to send a provider
• The same is true of subscriber details, which usually describe someone other than you: they are never saved, and leave the Service only in that one email
• Encryption in transit (TLS), encryption at rest for our database, and additional field-level encryption for your name, contact details, home address, dates of birth and your baby's name
• Limited internal access on a need-to-know basis

We do not currently have Business Associate Agreements in place with the vendors that process this information, and we do not represent the Service as HIPAA-compliant. If you would rather not send insurance details to a third-party AI service, you can skip the card upload and enter only your carrier and plan type, and you can receive your coverage summary without giving us any contact information.

The lactation practice you engage with is responsible for its own HIPAA obligations.

You don't have to provide contact info. The coverage scan works without any name, email, or phone number.

Data access and deletion. You can request a copy of your data or ask us to delete it by emailing hello@getlatched.co. We will respond within 30 days.

Communications. If you provided contact info to connect with a provider, you can ask them or us to stop contacting you at any time.

We use industry-standard security measures including TLS encryption in transit, encryption at rest for our database, restricted access controls, and ongoing monitoring. No system is perfectly secure, but we work hard to protect your information.

Lacata Benefits is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe we have collected such information, please contact us so we can delete it.

We may update this Privacy Policy from time to time. We will update the "Last updated" date above. Material changes will be noted on this page.

Questions, concerns, or requests? Contact us at hello@getlatched.co.