Privacy Policy

Introduction

Kelmoss Ltd ("we", "us", or "our"), a company incorporated in England (company number 15629688), operates Remedy, our public-sector pension platform (including the free pension check). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and services.

Kelmoss Ltd, registered in England and Wales (company number 15629688). Registered office: 124 City Road, London, EC1V 2NX. VAT number GB489325742. ICO registration ZB775702. We are the data controller for the personal data described here.

We take your privacy seriously and have appropriate technical and organisational measures in place to protect your personal information while providing a service for finding, fixing and managing your public-sector pension tax position and financial documents.

Who sees your records

When you ask us to fix a year, a specialist on our team opens your case and reads the documents and figures behind it — your pension savings statements, payslips, P60s and the position we have worked out — before the pack reaches you. That check is carried out by named members of our own team, not by a third party. The notice that a pack is waiting includes your email address so they can find your case.

If you invite an accountant or adviser, they see only the files you consent to share. Scheme administrators and employers hear from us only when you ask us to contact them.

Jurisdiction and Governing Law

This Privacy Policy is governed by English law. Any disputes arising from or related to this policy will be subject to the exclusive jurisdiction of the courts of England and Wales. We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Information We Collect

Free pension check (without an account)

Our free check lets you answer a short questionnaire and receive a triage-only result (red, amber, or green). It does not calculate a personalised tax charge for your situation. That requires your documents and our deterministic calculator after you create an account.

Cookies and Tracking

This section is our cookie policy. We use cookies and similar technologies (including local storage where noted) to provide and improve our service. You have full control over non-essential cookies through our cookie consent banner and settings.

How We Use Your Information

We use your information to:

• Provide and maintain our services
• Process your payments and subscriptions
• Send you important updates and notifications
• Improve our services and user experience
• Analyse document contents for pension and financial insights
• Check your scheme's figures against your payslips and other records, and work out your pension tax position
• Have a specialist on our team check the pack for a year you have asked us to fix, before the pack reaches you
• Check how a document of yours was read, for accuracy, as part of providing the service to you
• Check and improve how accurately we read documents and calculate for every member, using the figures members and their accountants correct (see Improving how we read documents and calculate)
• Where you ask us to handle your case, contact your pension scheme, administrator or employer on your behalf to obtain your records or correct errors in your record
• Where you ask us to, prepare your reconciled position for review or sign-off by a qualified accountant or independent financial adviser. An introduction is not access until you grant consent
• Respond to your inquiries and support requests
• Comply with legal obligations
• Prevent fraud and abuse
• Enforce our terms of service

How We Share Your Information

We do not sell your personal information. We share it only in these ways:

• Specialists on our own team: as described under Who sees your records. They receive your data so they can check the pack (UK GDPR Article 13(1)(e)). They are not listed as subprocessors because they act for us, the controller, as our own staff.
• Service providers (processors): the organisations in our subprocessor register below process data on our behalf under contract.
• Your pension scheme, administrator or employer: where you ask us to handle your case and with your authorisation, we may contact them on your behalf to obtain your records or correct errors in your record. We share only what is needed for that purpose.
• A qualified accountant or independent financial adviser (IFA): where you ask us to arrange professional review, sign-off, or an introduction, we share your reconciled position and supporting documents with the professional you choose or we introduce. That professional acts as a separate data controller, responsible for their own use of your data. If you invite an accountant or adviser yourself, they see only the files you consent to share.
• Legal and safety: where required by law, to enforce our terms, or to prevent fraud or harm.

We ask for your consent or instruction before contacting a scheme, employer or professional about your case.

Artificial intelligence and other processors

Core features use third-party AI and infrastructure providers. Depending on how you use the service, we may send content to these providers for processing (for example prompts, chat messages, document text or excerpts, and related context). Providers act as processors under their own terms and privacy policies.

Before sending text to external AI services, we apply best-effort automated redaction of common personal-identifier patterns (for example styles of NI numbers, NHS numbers, dates of birth, email addresses, phone numbers, and postcodes) where that pipeline is enabled. A scanned document or a photo is also read from its page images, so that tables print reliably; the same kinds of identifiers are blacked out on each image before it is sent. This is not a guarantee that all sensitive or special-category data will be removed. Only upload or enter what you need for your use.

AI processing may involve transfer and storage outside the UK (including the United States), depending on the provider’s infrastructure and configuration. Several of the providers below are United States companies, including Neon, OpenAI, Anthropic, Stripe, Resend, Sentry, PostHog and Browserbase. Our database and file storage are in London. We make those transfers under the UK International Data Transfer Addendum to the EU standard contractual clauses, or the UK Extension to the EU-US Data Privacy Framework, as applicable to each provider.

Data Security

We implement technical measures to protect your personal information, including:

• HTTPS (TLS): encrypts data between your device and our website and APIs
• Passwords: stored as bcrypt hashes, not plain text
• Sessions: signed JWTs in httpOnly cookies
• Database: PostgreSQL; our application requires TLS to the database in production (sslmode=require)
• Access control: authentication required for account data; role-based controls for administrative features
• Logging: selected actions (e.g. document sharing, subscription and security events) are logged for support and security review
• Payments: card data handled by Stripe under their standards; we do not store full card numbers on our servers
• Encryption at rest: provided by our hosting and database providers where they offer it. We do not operate a separate "end-to-end" encryption layer for file contents

We review and improve security as the service evolves. We do not list specific audit or penetration-test schedules here; ask us if you need detail for procurement or risk assessment.

Data Retention and Deletion

We retain your personal information for as long as necessary to provide our services and comply with legal obligations. Specific retention periods apply to certain features:

• Free pension check (no account): anonymous session data (answers, email if captured) is deleted after 90 days. See the Free pension check section above.
• Registered accounts: data is kept while your account is active.
• Corrections used to improve reading: review copies of redacted excerpts are deleted when the review is finished and within 30 days at most; the test cases we keep contain nothing from your documents. See Improving how we read documents and calculate.
• Connecting a pension or payroll account: when you choose to connect an account (for example My NHS Pension or the Electronic Staff Record), you sign in on the real page shown live from a browser we run. What you type goes straight into that page and is never stored, logged or sent anywhere else by us; the browser is closed when the session ends and cannot sign in again without you. We keep the records the portal gave us (statements, payslips and the figures behind them) while your account is active, because your calculation cites them. The page images and screenshots taken during the session, which exist only so we can check the collection worked, are deleted automatically after 90 days. All of it is deleted with your account.

You can request deletion of your account and associated data at any time. Upon deletion request:

• Your account will be deactivated immediately
• Personal data will be deleted within 30 days
• Linked free-check sessions are removed with your account (database cascade)
• Your rows leave the live database immediately. We keep encrypted database backups for 90 days, so your data leaves the backups as they expire
• Anonymised analytics data may be retained
• An accountant's or adviser's own records about your case are kept for their firm, and the firm is told: see If you work with an accountant or financial adviser

Your Rights Under GDPR

Under the UK GDPR, you have the right to:

• Access your personal information
• Correct inaccurate information
• Request deletion of your information
• Object to processing of your information, including our use of your corrections to improve reading: turn it off in Settings → Privacy
• Receive a copy of your information: download it from Settings → Privacy at any time
• Withdraw consent at any time
• Complain to the Information Commissioner's Office (ICO)
• Request restriction of processing
• Data portability: the Settings download is one JSON file you can take elsewhere

To exercise any of these rights, email our data protection lead at support@remedy.tax. We will respond within 30 days. We are a small company and are not required to appoint a statutory Data Protection Officer, so the lead is a director of the company.

If you are unhappy with how we handle your personal data, you can complain to the Information Commissioner's Office (ICO), the United Kingdom's data protection regulator, at ico.org.uk/make-a-complaint (opens in a new tab). We would welcome the chance to put it right first: see how to complain.

Updates to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. This policy tells you how we use your information; it is not a request for your consent. Where we rely on your consent, we ask for it separately.