Legitimate Interests Assessments

1. Content moderation and safeguarding screening

The purpose

We screen user-generated content — profiles, support group posts, community posts and replies, direct messages, Wisdom Bridge messages and Cafe messages — for signs of grooming, financial abuse, exploitation, self-harm risk and abusive language. Screening uses a keyword list maintained by our safeguarding team together with a semantic AI layer. Content that is flagged is held from publication and placed in a human review queue; a person, not a machine, makes the final decision.

The personal data processed is the content itself, the author's account identifier, the surface the content was posted on, and the resulting moderation decision and audit record.

Lawful basis: UK GDPR Article 6(1)(f) legitimate interests. Where flagged content reveals special category data, we additionally rely on Article 9(2)(c) vital interests or Article 9(2)(g) substantial public interest (safeguarding of children and individuals at risk, Data Protection Act 2018 Schedule 1 Part 2 paragraph 18).

Why it is necessary

Same Street exists to connect people through difficult life experiences. A large proportion of our members are care home residents, people living with cognitive impairment, recently bereaved people, and older adults experiencing severe loneliness — the exact group that grooming, romance fraud and financial abuse target.
Consent is not a workable basis here. A person attempting to groom or defraud a resident would simply decline consent to be screened, which would defeat the purpose entirely. Screening only those who agree to it would leave the most at-risk members unprotected.
There is no less intrusive way to achieve the same outcome. Manual review of every message by staff would expose far more content to far more human eyes; reactive moderation — acting only on reports — depends on a vulnerable person recognising and reporting their own abuse, which is precisely what exploitation is designed to prevent. Automated pre-publication screening looks at the minimum content necessary and escalates only a small flagged subset to a human.
The processing is also necessary to meet our duties as a regulated online service under the Online Safety Act 2023 and to support the safeguarding obligations of the care homes whose residents use the platform.

Balancing test

Nature of the data: message and post content, which can be personal and occasionally sensitive. This raises the bar for justification, and is why our safeguards are strict.
Reasonable expectations: members are told during onboarding, in the Community Guidelines and in this notice that content is screened for safety. Being protected from grooming and fraud on a platform built specifically for vulnerable adults is what our members expect, and care homes require it before permitting residents to join.
Impact on the individual: the impact of screening on an ordinary member is minimal — nothing happens to content that is not flagged. Where content is held, publication is delayed pending human review and the author is informed. Screening is never used for advertising, profiling for commercial purposes, or automated account termination.
Vulnerable adult user base: this is the decisive factor. Our members are disproportionately unable to protect themselves from the harms screening detects. Many have reduced capacity to recognise manipulation, are socially isolated (removing the informal safeguard of friends and family noticing), and hold savings or property that make them targets for financial abuse. Where a vulnerable adult's safety is weighed against a marginal privacy intrusion on the sender of a message, the safety interest is materially stronger. The Care Act 2014 and Mental Capacity Act 2005 both recognise this asymmetry.
Safeguards applied: screening is limited to the content and its author; flagged content is visible only to named safeguarding reviewers; every automated decision is logged in an audit record; high-confidence alerts sent to safeguarding staff by email contain the risk classification and a link only, never the message content; retention follows our published retention schedule; and members can object to processing, request the reasons for a hold, and challenge any moderation outcome through our appeals route.

Assessment outcome: legitimate interests may be relied on. The interest in preventing serious harm to vulnerable adults substantially outweighs the limited privacy impact on members, given the safeguards above.

2. Fraud prevention and account security

The purpose

We process account and device signals to prevent fake accounts, impersonation of care home staff or mentors, one-time passcode (OTP) abuse, and financially motivated fraud against members. This includes phone verification attempts and outcomes, sign-in and new-device events, IP addresses, rate-limiting counters, professional register checks for mentor applicants, and security event records.

Lawful basis: UK GDPR Article 6(1)(f) legitimate interests, alongside Article 6(1)(b) where verification is necessary to provide the service you have signed up for.

Why it is necessary

Without these checks anyone could create an account posing as a care home manager, family member or verified mentor and gain trusted access to residents. Verification and register checks are the only realistic way to establish that a person claiming a position of trust actually holds it.
Security telemetry — failed OTP attempts, brute-force lockouts, new-device alerts, denied staff access — cannot be gathered on a consent basis, because the accounts we most need to detect are those operated by someone acting dishonestly.
We use the minimum signals that work: we do not build behavioural profiles, we do not buy third-party fraud scores, and we do not track members across other websites.

Balancing test

Nature of the data: contact and technical security metadata (phone number, IP address, device and timestamp information, verification outcomes). It is not special category data.
Reasonable expectations: users expect a platform holding sensitive wellbeing information to verify identity and to warn them about unrecognised sign-ins. New-device alerts are a benefit to the member, not just to us.
Impact on the individual: low. A legitimate member experiences one verification step and occasional security notifications. Adverse consequences — lockout or suspension — arise only from the individual's own repeated failed or abusive attempts, and can be resolved with our support team.
Vulnerable adult user base: romance and courier fraud disproportionately target isolated older adults, and losses are frequently life-altering and unrecoverable. A member with cognitive impairment cannot be expected to detect a convincing impersonator, so the platform must carry that burden. This tips the balance clearly in favour of processing.
Safeguards applied: security events are readable only by our safeguarding and administration roles, never by other members; masked display is used for phone numbers throughout the interface; OTP verification logs are deleted after 30 days; access is logged; and members may object to processing or ask us to explain a security decision affecting them.

Assessment outcome: legitimate interests may be relied on. The privacy impact is low and proportionate, and the harm prevented is severe and often irreversible for our user base.

3. Platform improvement and trend analysis

The purpose

We analyse how Same Street is used in order to improve it — which features are used, where people abandon onboarding, which support groups are under-served, whether accessibility settings are being found, and aggregate patterns in engagement that suggest a feature is confusing or failing.

Lawful basis: UK GDPR Article 6(1)(f) legitimate interests. Analytics cookies and any non-essential browser storage additionally require your consent under PECR, and are not written before you accept them.

Why it is necessary

We cannot make the platform easier for an 84-year-old resident to use by guessing. Aggregate usage data is the only reliable way to find where people get stuck, and improving those journeys directly serves the members whose data is analysed.
We do not need identifiable data for this purpose, so we do not use it: analysis is carried out on aggregated and pseudonymised data, and results are reported at group level, never at the level of a named individual.
Special category data is excluded from this purpose. Mood check-in content, welfare and safeguarding records and Wisdom Bridge content are not used for platform improvement or trend analysis. Where health-related information would otherwise be involved, we rely on your separate consent, not on legitimate interests.

Balancing test

Nature of the data: aggregated, pseudonymised behavioural and usage data. No special category data and no message content.
Reasonable expectations: users reasonably expect a service to measure whether its own features work. This is ordinary, well-understood processing with no commercial data-sharing element.
Impact on the individual: negligible. No decision is made about any individual on the basis of this analysis, there is no automated decision-making, no advertising, no profiling for marketing, and no sale or sharing of data with advertisers or data brokers.
Vulnerable adult user base: because our members are more likely to face barriers around digital confidence, sight, hearing, dexterity and memory, this analysis is not a commercial nicety — it is how we identify and remove those barriers, which is a direct benefit to the same people whose usage is measured. Equally, we recognise that a vulnerable member is less able to scrutinise how their data is used, so we deliberately hold this purpose to the narrowest scope of the three assessed here.
Safeguards applied: aggregation and pseudonymisation by default; special category data excluded; no non-essential storage before consent; analytics consent can be withdrawn at any time in your privacy settings; and an absolute right to object to processing for this purpose, which we will always honour because the purpose does not depend on any individual's inclusion.

Assessment outcome: legitimate interests may be relied on for aggregated, pseudonymised analysis only, with analytics storage gated behind consent and an unconditional right to object.

Your right to object

Where we rely on legitimate interests you have the right to object to the processing at any time. Write to our Privacy Lead at privacy@samestreet.co.uk and we will stop unless we can show compelling grounds that override your rights — which, for safeguarding screening, will usually mean the protection of a person at risk of harm. These assessments are reviewed at least every 12 months and whenever a relevant feature changes. See also our Privacy Notice.