Waves data privacy and AI policy

Last updated: 18th September 2025.

1. INTRODUCTION

Demos is an independent, educational charity, registered in England and Wales (Charity Registration No. 1042046) (Demos, we, us or our). We are committed to protecting your privacy and security.

This policy sets out important information for those participating in different stages of the Who Cares? conversation (also known as the Waves deliberative process) (the Conversation), including how technology, including AI, is used throughout the process and how we safeguard your personal information.

2. WHO IS RESPONSIBLE FOR YOUR PERSONAL DATA?

Demos is the primary controller and is primarily responsible for your data and its protection across all stages of the Conversation. Our contact details are set out in Section 12 below.

We use two data processors to process your personal data on our behalf: Remesh Inc and Psi. More information about these processors and their roles in the Conversation is set out below.

We also use Stripe Payments Europe as a processor to make payments to you for any cash prizes you may win as part of the Conversation. We provide more details about this at Section 6 below.

At certain stages of the Conversation, some of your personal data will be shared by us with the Sortition Foundation. The Sortition Foundation will share that personal data it has received from us with the London Borough of Camden Council. When this happens, the Sortition Foundation and the London Borough of Camden Council will be independent controllers of your personal data. They will process that personal data in accordance with their privacy policies. Camden’s is here. Sortition’s is here.  We encourage you to review these policies.

Further detail about the data sharing arrangements between us and these other organisations is set out below.

3. THE INFORMATION WE COLLECT AND WHO HAS ACCESS TO IT

Which stage in the Who Cares? conversation are you participating in?

The ‘Who Cares?’ conversation has four stages. Depending on which stage of the process you are participating in, we will ask different questions and different organisations will have access to your answers and any personal information you share.

Check the dates in Table 1 below if you are unsure which stage you might be participating in.

Table 1: ‘Who Cares’ conversation stages and dates

What personal information is being collected and why.

The personal data we may collect from you depends on what stage you participate in.

Where we refer to ‘personal data’ in this privacy policy, we are referring to any and all personal data you share with us as part of the Waves (Who Cares?) programme and the Conversation unless otherwise stated.

If you only participate in Stage 1 and/or Stage 3, you do not have to identify yourself to us. If you do not identify yourself (for example, by providing us with your name or email address), the data you provide will not be identifiable to us and therefore will not be considered as qualifying as personal data under the UK GDPR. The contents of this policy will then not apply to you.

If you only participate in Stage 1 and/or Stage 3 and you choose to identify yourself, we will collect and process, at a minimum:

• Contact Data: including but not limited to your name, email address, postcode or telephone number.
• Contribution Data: information that you choose to contribute to the Conversation, such as your opinion on ideas shared by other participants (which may include special category personal data, if you choose to share it with us – further information around special category personal data is set out below).
• Voting Data: information about how you voted on the ideas put forward by other participants in Stage 1 and/or Stage 3.

If you participate in any of the Stages and would like to enter into our cash prize draw, we will also require your bank information (account number, sort code, card number) in order to pay you the cash prize if you win.

During Stage 1 and/or Stage 3, you will be asked to share the personal data in Table 2. You do not have to share this personal data with us if you do not want to.

If you would like to participate in Stage 2 and Stage 4 (although you do not have to accept the invitation to be invited back to Stage 4), you will be asked to share the information set out in Table 2 in addition to any Contribution Data you wish to provide as part of the Conversation at Stage 2 and Stage 4. You do have to share this information if you wish to participate in Stage 2 and Stage 4.

We have explained why we ask for and, for Stage 2 and Stage 4, require this information in Table 2. 

Table 2: What personal data we will ask your consent to collect and why we are asking for this

Special category personal data

Special category personal data includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data. The law requires us to ensure that such special category personal data is protected and processed only under certain conditions.

We will collect and process special category personal data about you when:

• We ask you for information about your sexual orientation (see Table 2 above).
• We ask you for information about your health and/or disability (see Table 2 above).

We will also collect and process special category personal data when you choose to provide it to us – for example where you share your Contribution Data with us and your contribution refers to your specific health requirements or information about your ethnicity. 

Third party personal data

We would ask that you do not share any personal data about or relating to individuals other than yourself – we can’t be sure whether they want to be included in the Conversation or not.

For example, if you want to provide information that relates to someone else, make sure that they are anonymised (you can say ‘your friend’ instead of their name). 

4. HOW WE USE THE INFORMATION YOU SHARE WITH US AND WHY

We will only use your personal data where it is necessary for the following purposes:

• To analyse consensus and patterns in the Conversation about adult social care to inform Camden Council decision-making.
• To select representative participants for the in-depth deliberation Stages 2 and 4.
• To make awards of cash incentives to individual participants.
• To assess the diversity of participation across the Camden population in each stage.
• To evaluate the effectiveness of digital democracy tools and processes for future implementation.

These purposes will assist us and third parties in achieving the following outputs of the Waves (Who Cares?) programme:

• Policy recommendations informed by resident conversations for Camden Council decision-making.
• Best practice guidance and toolkits for implementing future discussions that also use digital technologies in the same way in other local authorities.
• Academic research papers that evaluate the benefits of using digital technologies in Conversations like this one.

We will not use your personal data for any other purpose. This includes the personal data that we anonymise as part of the Waves (Who Cares?) programme.

5. LAWFUL BASIS FOR PROCESSING

The law requires us to have a legal basis for collecting and using your personal data to facilitate the Conversation and produce the Waves (Who Cares?) programme.

In relation to the processing of personal data set out in Section 3 above (including any special category personal data) for the purposes set out in Section 4, we are relying on the lawful basis of our “legitimate interests” and those of third parties (for example, Camden Council and members of the public policy community, such as academics and researchers).

The legitimate interests we and those third parties have is in:

• Incentivising participants to contribute to community discussions around adult social care.
• Developing adult social care policy recommendations and policies.
• Improving guidance and academic learning about adult social care.
• Facilitating diverse and ethical feedback to policymakers and advisors.

Please note that where Camden Council and the Sortition Foundation are in receipt of your personal data, they may have set out a different lawful basis in respect of their processing.

Where we process special category personal data about you, we are required to identify both the lawful basis of processing (legitimate interests, as above) and a ‘special condition’ for that processing.

The special condition we are relying on is explicit consent.

Prior to participating in the Conversation, we ask for your explicit consent for us to process your special category personal data. You do not have to give your consent if you do not want to – although we will be unable to register your interest to participate in Stages 2 and 4 if you do not provide us with the relevant special category personal data we request (see Section 3 above). You do not have to provide any special category personal data in your Contribution Data if you do not want to. If you do provide us with your consent, you are able to withdraw this consent at any time. If you wish to do so, please contact us at the details provided in Section 12 below.

6.  WHO ELSE HAS ACCESS TO YOUR DATA?

Please check which stage you are participating in (see the table above entitled: “‘Who Cares’ conversation stages and dates”) and see below for which other organisations will be either processing or gaining access to your data for specific purposes.  

If you are participating in Stage 1 or 3 of the conversation

As set out above in Section 2, Remesh Inc. is our data processor and the third party who will be assisting us with facilitating the Conversation at Stage 1 and Stage 3. Data processors are required to follow our instructions when it comes to the processing of your personal data. We have agreements in place with Remesh Inc to facilitate this, in line with the law.

The personal data flows in Stage 1 and Stage 3 are as follows:

If you are participating in Stage 2 or 4 and using the Psi website…

As set out above in Section 2, Psi is our data processor and the third party who will be assisting us with facilitating the Conversation at Stage 2 and Stage 4. We have agreements in place with Remesh Inc to facilitate this, in line with the law.

The personal data flows in Stage 2 and Stage 4 are as follows:

If you are selected to win a cash prize or receiving a cash incentive for participating in Stages 2-4

Any financial data that is collected for the purposes of making payments to you for cash prizes or incentives will be passed to our payment provider: Stripe Payments Europe. We do not store card details or banking information. We use Stripe card services instead which comply with the payment card industry data security standard (PCI-DSS) published by the PCI Security Standards Council. Stripe will never share your banking information details.

7. HOW WE USE AI DURING THE CONVERSATION

As set out in part above, there are two main technology-enabled tools being used throughout the Waves process:

• Remesh Inc – a deliberative platform that is used in Stage 1 and Stage 3 of the process
• Psi – a deliberative platform that is used in Stage 2 and Stage 4 of the process

We go into detail about how Remesh Inc and Psi use AI during the Conversation and in respect of the personal data you may provide.

We have also arranged for participants in Stage 2 and Stage 4 to access ‘KnowMore’ – a tool to help participants ‘KnowMore’ about the policy area being discussed. KnowMore is also only used during Stage 2 and 4 of the process and does not require any personal information to use. For the avoidance of doubt, we have detailed the AI tools made available to you as part of KnowMore below.

How is Artificial Intelligence (AI) used in the Remesh website?

With Remesh Inc and its website platform, AI is used to help enable a higher number of participants to participate in the process than would be possible if offline and face-to-face. It uses AI in the following ways.

Everyone (1,000s of people) can submit their ideas in their own words and have their ideas voted on by other people as part of Stage 1 and Stage 3. However, it’s not possible for every participant to vote on every person’s ideas as this would take too long. So, Remesh Inc:

1. Groups all of the different ideas together (‘response grouping’) using AI (a combination of LLMs and various clustering techniques) so that there are groupings of very similar ideas.
2. Uses AI (an LLM with a latent factor model) to use the votes a person gives to a response in each group to predict how they would vote on the ideas that have been shared. This is called ‘elicitation inference’. It provides an estimation of every participant segment’s agreement with every response.
3. Uses AI (LLMs) to summarise the 1000s of different ideas so that they can be analysed quickly.

Why is Artificial Intelligence (AI) being used in the Remesh website?

It can be difficult for a high volume of residents to participate in discussions that involve sharing ideas about how to solve a policy problem because not everyone can give feedback on everyone else’s ideas. For example, if 1,000 people submitted an idea each, this would mean each person had to give feedback on 1,000 ideas. That would be too time-consuming for each person! It would also be very time-consuming to analyse all of the ideas!

The Remesh platform allows thousands of people to share their ideas to a policy problem or question. Then each person is asked to vote on a small number (e.g. 5) of other people’s ideas that have been shared before them. Using how someone has voted, the technology then predicts how you might vote on the other ideas that have been shared. Based on performance testing over the last 10 years, this technology can do this with very high accuracy. This allows the Council to then see which ideas that have been shared by residents have achieved the greatest consensus among residents, including across different people who might typically disagree, and therefore which they should take forward.

How is AI used in the Psi website?

AI is used for different purposes across the Psi website.

• It’s used for real-time translation so that participants who speak, for example – Somali – can see a real-time translation of what is being said in English and in Somali.
• For transcription – so that when people are answering a question, what they are saying is transcribed quickly. This means that discussions (which could be 40 at the same time) don’t need note-takers.
• For analysing the themes of the ideas that are shared by participants in the discussions and allowing analysts to understand many hours of conversations in detail.
  • For analysing the data, it uses AI-based techniques called: semantic embedding, dimensionality reduction, clustering (Hbdscan) and retrieval augmented generation (RAG).
  • For summarising discussions in a way that allows those moderating the discussion to understand the detail of the key topics quickly. For this, the tool uses: LLM summaries and grounding, LLM highlights and grounding and LLM chat and grounding.

In simple terms, AI technologies allow for advance translation techniques and methods of data analysis that exceed what a team of people could do.

Why is AI used in the Psi website?

We want more Councils to engage (more) citizens in decision-making and for that process to be simpler and less expensive as well as for the analysis and feedback to communities to be easier and better quality i.e. easier for residents to see where there was consensus and therefore why a decision has been made. We think this will encourage more Councils to use these processes and to open them up to more people.

The Psi platform allows up to 120 people to participate in a discussion at the same time online in a way that:

• Doesn’t need lots of staff members to facilitate the discussion – though they can listen and learn about what the participants are saying.
• Analyses where participants agree and disagree quickly so that participants can then focus on the things they agree on faster. It does this in a way that is visible to participants and can be shared with residents after the process is complete so they can trust the results more.
• This makes the process easier to run. We hope this will encourage more Councils to conduct these processes so that more citizens can be a part of decision making.

How is AI used in the KnowMore tool?

AI is used in the KnowMore tool as a way of summarising and simplifying vast amounts of information. By feeding a large library of datasets and documents into the AI, participants can ask questions about existing facts and figures, different suggested policy proposals, current legislation, etc. and receive a balanced summary from KnowMore, with links to the relevant passages in the original documents so participants can read the full background versions for themselves. It is impossible to expect people to read hundreds of documents before participating – so the KnowMore tool acts as an expert that has read the documents for you, and can answer questions regarding their content.

Why is AI used in the KnowMore tool?

At the moment, it can be difficult for participants who don’t know a policy area very well to feel confident participating in discussions about it. Participants can feel this way even if they are given further information by experts or the opportunity to ask questions during the session. This can be a barrier for some participants wanting to participate in discussions as they feel they ‘don’t know enough’. It can also create a power imbalance where participants feel dependent on ‘experts’ or the information summarised by others in order to know more about an issue. Participants may not trust the experts in the room or want to ‘know more’ than what they’re being told in the time available.

‘KnowMore’ allows participants to know more by allowing them to ask questions about a policy area and to get answers to their questions without needing to rely on an expert or to read hundreds of documents.

• The tool uses a large library of documents about a policy that has been quality checked by the Council and the Demos team. Participants can view the list of documents that are included.
• The tool uses AI to summarise these documents into small sections that relate to particular topics.
• The participant can then ask any question and the AI will be used to answer this question using simple language and drawing on the documents it has access to.

Is my data being used to train AI models?

We recognise the points raised by the UK data protection regulator, the ICO, around certain types of AI techniques. The main point is that AI “learning” techniques can mean that individuals lose control over how their personal data is used, because once an AI “learns” from a piece of data that data can exist within the AI models themselves. You can read more about this (and the use of AI more generally) here.

To address this point, we have ensured that your personal data will not be used to permanently “train” (part of the AI learning process) AI models.

The Remesh platform on its website, as set out above, does use certain techniques that will result in an AI “learning” from your personal data. This is to create a unique AI model that is used specifically for your individual Conversation. When the conversation is complete, the AI model is deleted, ensuring that no further AI learning takes places.

Are any decisions being made using AI or any other automated means?

No, decisions are not being made with AI. There is no automated decision making in place as part of any Conversation or the Waves (Who Cares?) programme. You and other participants will share your own views about adult social care throughout the conversation without any interference from AI in those views.

Outside of the Conversation, as above, Demos will analyse the results and Camden Council will draw conclusions and make policy decisions (not decisions about you) based on the results. These results and conclusions will be published and available for the public to view on the Camden Who Cares? webpage.

You will also be able to see what proportion of people participated in the discussion (in such a way that those people are not identifiable). You can also ask questions about these results and how they have been produced to Demos by contacting us.

8. INTERNATIONAL TRANSFERS

Except as set out below, your personal data will not be held outside of the UK.

Remesh Inc is based in the United States.

As Remesh Inc is collecting your personal data on our behalf directly and sending it to us, that is not a ‘restricted transfer’ within the meaning of the UK GDPR because the personal data is flowing from Remesh Inc to us. Therefore Remesh Inc (and us) would remain subject to the UK GDPR automatically even though your personal data is being held in the US.  

However, for the avoidance of doubt, Remesh Inc is certified under the UK-US Data Bridge and the EU-US Data Privacy Framework. This means that if we were to make a ‘restricted transfer’ of your personal data to Remesh Inc, we could do so, and your personal data would remain subject to adequate protections equivalent to the UK GDPR. 

9. HOW WE PROTECT YOUR DATA DURING AND AFTER THE CONVERSATION

We and our processors Remesh Inc and Psi have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.

For us, electronic data and databases are stored on secure computer systems and we control who has access to information (using both physical and electronic means). Our staff receive data protection training and we have a set of detailed data protection procedures which personnel are required to follow when handling personal data.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

Our processors will only process your personal data on our instructions and they are subject to a duty of confidentiality.

Between us, Camden Council and the Sortition Foundation, we have put in place a data sharing agreement that controls how your personal data is shared between us for the purposes of the Conversations and the Waves (Who Cares?) programme.

If you want to know more about how we protect your personal data and the contractual arrangements we have in place between Remesh Inc, Psi, Camden Council and the Sortition Foundation, please contact us.

10. STORAGE

Demos stores all personal data safely and securely in an encrypted area of Demos’ Microsoft drive. It will be deleted after a maximum of 1-year (by October 2026).

As set out above, Remesh Inc and Psi delete your personal data after it has been sent to us at the end of the relevant Stage (after their relevant analysis has concluded). This period will not exceed 2 months from the end of the relevant stage.

Camden Council and the Sortition Foundation will retain your personal data for the period described in their privacy policies. 

11. KEEPING YOU IN CONTROL

We want to ensure you remain in control of your personal data. Part of this is making sure you understand your legal rights, which are as follows:

• Request access to your personal data (commonly known as a “subject access request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
• Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
• Request erasure of your personal data in certain circumstances. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
• Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) as the legal basis for that particular use of your data (including carrying out profiling based on our legitimate interests). In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your right to object.
• Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
• Withdraw consent at any time where we are relying on consent to explicit consent to process your special category personal data (see Section 3). However, this will not affect the lawfulness of any processing carried out before you withdraw your consent.
• Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in one of the following scenarios:
  •  if you want us to establish the data’s accuracy;
  • where our use of the data is unlawful but you do not want us to erase it;
  • where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or
  • you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.

Please keep in mind that there are exceptions to the rights above and, though we will always try to respond to your satisfaction, there may be situations where we are unable to do so.

No fee usually required

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

What we may need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

Time limit to respond

We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

12. CONTACT INFORMATION

If you have any questions about this privacy policy or about the use of your personal data or you want to exercise your privacy rights, please contact us in any of the following ways:

• Email address: [email protected]
• Postal address: Demos, 15 Whitehall, London SW1A 2DD
• Telephone number: 020 3878 3955 (Lines open 9.30am – 6pm, Mon – Fri).

13. COMPLAINTS

You have the right to make a complaint to the Information Commissioner’s Office (ICO), the UK regulator for data protection issues (www.ico.org.uk).

However, before doing so please make sure you have first made your complaint to us or asked us for clarification if there is something you do not understand.