Privacy Policy

Latched is designed to handle as little personal information as possible. We do not store images of your insurance card. We do not store names, dates of birth, or addresses from your card. We only keep what we need to give you a coverage summary and (if you opt in) to connect you with your lactation provider.

Information from your insurance card (ephemeral): When you upload a card image, we send it to a third-party AI service (Anthropic) to read the carrier name, plan type, member ID, group ID, and member services phone number. The image is held in memory for the length of the request and is never written to disk. Your member ID is never saved. Your group ID is used only to judge how confident we are in the result and is not saved either. We deliberately do not extract names, dates of birth, or addresses. Only the carrier name and plan type are kept.

Information from the chat: Your follow-up questions and our responses are processed by an AI service to answer you. Chat messages are not persisted to our database. We do record which category a question fell into — for example "breast pump coverage" or "referral requirements" — together with the carrier and plan type, so we can see which topics our knowledge base answers poorly. That record contains no message text and is not linked to you or to your coverage results.

Information you provide: If you choose to contact a provider through the widget, we collect your name, email, phone, and state. This information is shared with the practice you select.

How the widget is used: We record which step of the widget was reached — opened, card submitted, results shown, consultation requested — so providers can see where people get stuck. Each visit gets a random identifier that is discarded when you close the tab. These records contain no personal data and are not linked to you, to your coverage results, or to each other across visits.

Technical information: We collect basic technical information like browser type and IP address for security and analytics purposes.

The provider you chose: If you submit your contact information, the practice (e.g., your lactation consultant) will receive your name, email, phone, state, and coverage summary.

Service providers: We use third-party services to operate the Service. Each is bound by its own terms of service and data protection commitments:

• Anthropic (AI coverage analysis)
• Railway (application and database hosting)
• Resend (email delivery)
• Google Workspace (calendar integration, where a practice connects one)

We are working toward Business Associate Agreements with these vendors. Those agreements are not yet in place.
We do not sell your information. We do not share your data with advertisers or data brokers.

Latched is not a healthcare provider and is not a covered entity under HIPAA. We are an informational tool that helps you understand what your insurance plan is likely to cover.

We build with privacy-protective defaults:

• Minimum necessary data collection — no names, dates of birth, or addresses are read from your card
• Card images are never written to disk
• Member ID and group ID are read only to interpret your plan, and are never saved
• Encryption in transit (TLS), and encryption at rest for our database
• Limited internal access on a need-to-know basis

We do not currently have Business Associate Agreements in place with the vendors that process this information, and we do not represent the Service as HIPAA-compliant. If you would rather not send insurance details to a third-party AI service, you can skip the card upload and enter only your carrier and plan type, and you can receive your coverage summary without giving us any contact information.

The lactation practice you engage with is responsible for its own HIPAA obligations.

You don't have to provide contact info. The coverage scan works without any name, email, or phone number.

Data access and deletion. You can request a copy of your data or ask us to delete it by emailing hello@getlatched.co. We will respond within 30 days.

Communications. If you provided contact info to connect with a provider, you can ask them or us to stop contacting you at any time.

We use industry-standard security measures including TLS encryption in transit, encryption at rest for our database, restricted access controls, and ongoing monitoring. No system is perfectly secure, but we work hard to protect your information.

Latched is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe we have collected such information, please contact us so we can delete it.

We may update this Privacy Policy from time to time. We will update the "Last updated" date above. Material changes will be noted on this page.

Questions, concerns, or requests? Contact us at hello@getlatched.co.