Privacy

We don’t ask for your name, date of birth, member ID, or Social Security number, and we ask you not to enter them. We don’t store your questions or what you type into tools. We don’t sell or share information for advertising, and we don’t use advertising trackers.

Your questions may be about your health (a service, a drug, a condition). We use them only to answer you at that moment. We don’t store them in our database, sell them, use them for advertising, or share them, except with the service providers that run the site (below), only for that purpose. Because we don’t link them to you, we usually have nothing of yours to show you or delete; if you think we do, write to us on the feedback page.

To learn which tools help people finish what they came to do, we keep daily totals: how many times each tool was opened, started, and finished, how searches turned out (answered, asked a follow-up question, didn’t match anything, or sent to a tool) with only the topic or tool and the language, and how people answered “Did this help?”. A total may be split by a clinic’s short code when you arrived from its handout or page. We never store your questions, your IP address, or any ID that follows you; nothing is finer than a day. A clinic’s code is random, identifies only the clinic, and stays with the browser tab you opened its link in; the clinic can see its own totals, with any number under 5 shown as “fewer than 5”. If your browser sends Global Privacy Control, nothing is counted.

If you answer “Not really” and add a note, we keep the note with which answer or tool it was about, so we can fix it. Email addresses, phone numbers, and long ID-like numbers are removed before it’s saved. Please don’t include names or health details. Notes are kept until we’ve reviewed and deleted them.

Some things are saved in your browser so you don’t start over: your coverage type, company, and plan (the covered_profile cookie), your language (covered_lang), whether you’re here as a patient or a practice (covered_audience), the drug list you build, form progress for appeals and prior authorizations for up to 120 days, and a practice’s list of open requests (initials or chart numbers only, never names or member IDs) until each row goes untouched for 120 days. An uploaded plan is kept for up to an hour. Search questions are in the page address, so they appear in your browser history and, for a limited time, in our hosting provider’s request logs. On a shared device such as a clinic tablet, use “Clear my information on this device” at the bottom of any page when you’re done.

A practice’s list of open requests can also be kept as a file: one you download and open by hand, or a file on the office’s own computer or shared drive that the page reads and writes with the browser’s permission (Chrome or Edge on a computer). The file stays on your equipment; Covered never receives it and can’t see it. The browser remembers which file you chose so it can ask you again next visit; “Clear my information on this device” forgets that choice but doesn’t touch the file.

Uploaded SBC, EOC, formulary, and policy PDFs are processed only to answer your question. The original file is discarded after extraction. Extracted passages are redacted for obvious identifiers, encrypted, and automatically deleted after 60 minutes. User documents are never added to the shared public catalog.

When a practice submits the insurance it takes, we store the submitter’s name, role, work email, and optional website to confirm and review the update. These are never shown publicly; only the insurance list, notes, and date appear. Unconfirmed updates are not shown, and approved ones expire after 12 months.

Vercel hosts the site, Neon stores the database, and Resend sends confirmation emails. The operator has turned on an optional AI service: only an ambiguous question, with identifiers removed, may be sent to it for interpretation, and it can’t decide coverage.

Covered isn’t directed to children under 13, and we don’t knowingly collect personal information from them.

Covered doesn’t connect to medical records or to clinic or plan systems. A clinic using it with patients should follow its own privacy rules; HIPAA roles, business associate agreements, and consent would need to be settled before any connection to clinic systems.

If we change this page, we update the date above. Questions or requests: the feedback page.