Privacy Policy

Latched is designed to handle as little personal information as possible. We do not store images of your insurance card. We do not store names, dates of birth, or addresses from your card. We only keep what we need to give you a coverage summary and (if you opt in) to connect you with your lactation provider.

Information from your insurance card (ephemeral): When you upload a card image, we send it to a HIPAA-eligible AI service to extract the carrier name, plan type, member ID, group ID, and member services phone number. The image itself is not stored. We deliberately do not extract names, dates of birth, or addresses.

Information from the chat: Your follow-up questions and our responses are processed by an AI service to answer you. Chat messages are not persisted to our database.

Information you provide: If you choose to contact a provider through the widget, we collect your name, email, phone, and state. This information is shared with the practice you select.

Technical information: We collect basic technical information like browser type and IP address for security and analytics purposes.

The provider you chose: If you submit your contact information, the practice (e.g., your lactation consultant) will receive your name, email, phone, state, and coverage summary.

Service providers under contract: We use trusted third-party services that are covered by Business Associate Agreements where required:

• Anthropic (AI coverage analysis)
• Supabase (database hosting)
• Resend (email delivery)
• Google Workspace (calendar integration)

We do not sell your information. We do not share your data with advertisers or data brokers.

Latched is designed to support HIPAA compliance through:

• Minimum necessary data collection
• Business Associate Agreements with vendors that may handle Protected Health Information
• Encryption in transit (TLS) and at rest
• Limited internal access on a need-to-know basis

Note: Latched provides informational coverage estimates and is not itself a healthcare provider or covered entity. The practice you engage with is responsible for their own HIPAA obligations.

You don't have to provide contact info. The coverage scan works without any name, email, or phone number.

Data access and deletion. You can request a copy of your data or ask us to delete it by emailing hello@getlatched.co. We will respond within 30 days.

Communications. If you provided contact info to connect with a provider, you can ask them or us to stop contacting you at any time.

We use industry-standard security measures including TLS encryption in transit, encryption at rest for our database, restricted access controls, and ongoing monitoring. No system is perfectly secure, but we work hard to protect your information.

Latched is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe we have collected such information, please contact us so we can delete it.

We may update this Privacy Policy from time to time. We will update the "Last updated" date above. Material changes will be noted on this page.

Questions, concerns, or requests? Contact us at hello@getlatched.co.