Candid

Insurers deny 19% of in-network marketplace claims. 262,982 out of roughly 85 million denied claims are ever appealed. That is fewer than one in a hundred, and 69% of insured adults never knew they had the right to appeal at all.

The gap isn’t apathy, it’s asymmetry. Around 95% of denials are paperwork rather than medicine, and when disputing, patients face a department that does this full time. This paperwork is why about 100 million American adults hold $220B of medical debt.

Every existing tool is a point solution: negotiate one bill, appeal one denial, find charity care. One transaction, no memory. No coverage context.

A one-stop shop for medical transparency. Five services on one shared data layer, so a patient can understand a plan, catch an overcharge, fight a denial and shop for fair prices without leaving the platform.

Put simply:

1. Candid Benefits parses SBC and EOC documents to tell users what services are actually covered.
2. Candid Claim audits bills and EOBs line by line for errors, upcoding, balance billing and duplicates.
3. Candid Case guides users through the dispute process, from phone scripts to dispute and appeal letters, to full case files that quote your plan and cite the law.
4. Candid Care surfaces provider price-transparency data and pricing specific to the providers in your region.
5. Candid Compare makes it easy to choose the right plan by comparing plans side by side, with modeling based on usage, family size and type of care.

Powering all of this is a five-stage data pipeline: ingest and OCR, classify the document type and layout, extract section by section, verify every quote against the raw file, then corroborate across members before anything becomes canonical. Eleven non-negotiable data rules hold the shared layer together: one canonical table per entity, billing codes as rows rather than columns, additive-only schema, and every value stamped with a confidence score and a source.

Stack: Next.js 16, React 19, TypeScript, Postgres, QStash, Firebase, Stripe, Vercel and Claude.

A wrong number is worse than no number, because a bad dispute costs a patient credibility they don’t get back. So every extracted field has to quote its source, and a five-key verbatim verifier checks each quote against the raw document. If it can’t be confirmed the field goes null, never wrong. An invented citation fails structurally instead of reaching a legal letter.

Claude Haiku 4.5 runs as the primary parser. Extraction is tool-use driven, and an independent calibration harness gates every change to the prompt or the pipeline.

Whole-table cite-grade accuracy runs at 94.38%, strict extraction precision at 89.67%, for about $0.23 a document and $0.01 on a cache hit. Verbatim quality on the longest plan documents went from 20% at MVP to 97.6% at launch.

OCR that only spends when it has to. Clean documents go through pdfjs at zero cost; only pages that draw text but decode to nothing (e.g. rotated tables, subset fonts) get routed to Document AI.

Resumable large-document jobs. A 100-page plan booklet outlasts the serverless ceiling, so Candid processes checkpoints through QStash with each chunk re-enqueueing itself rather than timing out at 800 seconds.

A real security program: IDOR defense on every route with anti-enumeration and lint guards, signed webhooks, durable rate limiting, and full right-to-erasure. Plus a dev environment cloned from a 565 MB production database down to 268 MB behind an exact row-parity verify gate, with zero writes to production.

Every number a user sees carries a badge for how it was established, on a four-rung provenance ladder: Verified, Community, Estimate, Unverified. Solid green “Verified” is reserved for values members have corroborated. Hence AI-enabled, human-verified.

The same rule governs the data. A value is promoted to the shared layer only when email-and-phone-verified members agree on the same cite-grade figure, through a single service-role RPC that application code cannot reach. Model confidence is metadata, never trust. That is what makes an adversarial upload unable to poison shared truth.

In front of it, plain English. “Your plan covers this at $0. The provider billed you $221 anyway.” The experience was tailored to be de-jargoned, one clear action per screen, the frightening parts explained rather than hidden.

Feature flags gate every user-facing change, nothing reaches production without a green-CI hard gate and a manual batched promotion, and all 205 migrations are additive-only and reversible. Daily cron jobs carry retries, alerts and a PII audit. Stripe is live end to end with consent versioning.

The build itself ran as a spec-driven loop, describe before code, phase gates, research to plan to implement to verify, with a rolling save-state across roughly 280 documented sessions, so the decision history stays queryable instead of lost. When a compute tier ran out of connections mid-migration it was recovered with zero data loss.

About 165,000 lines of TypeScript, 90 Postgres tables, 205 migrations, 1,317 canonical plans, 99,000 covered-service rows and 534,000 corroboration events. Built in roughly four months, from an empty schema to a flag-gated, Stripe-live, security-hardened platform.