Deronda Works Ltd
Privacy notice
Everyone Knows Roscoe helps members understand and use their benefits. It holds membership records and, where enabled, private conversations, requests and claim-submission information. This notice explains the main access boundaries; retention and the regulatory operating model require specialist review before a live claims pilot.
Who we are
Deronda Works Ltd operates Everyone Knows Roscoe, software used by employers, their insurance broker, and the people covered by an employer’s international private medical insurance. For the records an employer puts into Roscoe about its own people, the employer may act as a data controller and we may act as its processor. Roles for private member conversations and claim submissions must be set out in the relevant client and insurer arrangements; they are not assumed to be the same as roster administration.
What we hold about a covered person
A member’s record holds their name, date of birth, nationality and country of residence, an employee reference, a start date, a work email address, and whether they have taken up the cover. Where a spouse, partner or children are covered under the same policy, we hold the same details for them.
This is what an insurer requires to put somebody on cover, and what an employer needs to administer it. Roscoe holds it so there is one authoritative list rather than three partial ones — the employer’s spreadsheet, the broker’s email trail and the insurer’s system.
Roscoe may process health information you choose to put in a private conversation or an enabled claim submission, including treatment details and supporting files. The insurer, not Roscoe, decides and pays claims. Separate insurer-reported claims data may be used for validated, privacy-protected aggregate reporting.
What your employer and your broker can see — and cannot
Both can see the details above, because both administer your cover. Your broker sees the membership of the clients they are assigned to; they could obtain the same list from the insurer, and having it here is what lets them go to market at renewal without rebuilding it from email.
Your employer cannot see your private conversations, clinical claim details or claim files. A confirmed claim submission goes only to the approved insurer destination and the member copy address shown before sending. Aggregate reports must meet their data-source and privacy thresholds; an unavailable insurer feed is not shown as zero.
Requests, and how briefly they hold detail
A request to add or change someone carries their details while it is open, so whoever actions it can act. Those details are not copied into the audit trail or into any notification, and they are cleared once the request moves through its workflow. Access to the request details is restricted to the people who need to action it; an audit record of the workflow may remain after the request closes.
Retention differs for membership records, requests, conversations, claim drafts and submitted evidence. A live client’s periods and deletion procedures must be agreed and recorded before sensitive workflows are enabled.
Enforced, not promised
Access controls are enforced server-side and in the database, with automated permission tests. We also use route-specific checks before a private claim submission can be prepared or sent. Those controls still require independent privacy and security review for a live pilot.
Who else sees anything
- Your employer’s insurance broker — the clients they are assigned to, the policies they placed, and claims as the same aggregates, for the purpose of advising on and renewing the cover.
- An investor, where your employer has one on Roscoe — identity only (that the company is on Roscoe, its headcount, its renewal month) unless your employer has switched financial sharing on. That switch belongs to your employer and can be turned off again, at which point the figures stop.
- Approved service providers and insurer routes — only for the relevant service or a member-confirmed handoff. We do not sell member data or share it with advertisers.
Companies that process data for us
- Supabase — the database and sign-in, hosted in London (eu-west-2).
- Vercel — application hosting.
- Resend — sending invitation and notification emails and, only where approved and enabled, member-confirmed handoffs.
- Cohere — where the member assistant is configured and enabled for your employer. Your question and text from reviewed documents attached to your assigned plan are processed to find relevant passages, draft an answer and check it against the documents. We do not add your member profile, name or email to these requests. Documents or questions may themselves contain personal information; please avoid including medical history or other people’s details in your question.
Tracking
There is none. No analytics, no advertising pixels, no third-party scripts, and no cookie banner — because there are no cookies to consent to until you sign in. See the cookie statement, which is short enough to read.
How long we keep things
Member records may need to remain after cover ends to establish who was covered on a particular date. Private conversations, request payloads, claim drafts, submitted evidence, audit records and backups have different purposes and retention requirements. The final periods and deletion arrangements for a live client need to be documented in its privacy and service terms before those workflows are activated.
Your rights
You can ask for a copy of what we hold about you, ask us to correct it, or object to how it is used. Where your employer is the controller, we will pass the request to them and help them answer it. Write to privacy@deronda.works. If you are not satisfied, you can complain to the Information Commissioner’s Office at ico.org.uk.
Changes
If this notice changes in a way that affects what we hold or who sees it, the date at the top changes and anyone signed in is told. We do not make a material change quietly.