inyourroots® Safeguarding Policy

• Young people using inyourroots®
• Parents, carers and supporters
• Employers, mentors and anyone working with us
• Our team, freelancers and volunteers

Budi is the AI career companion inside inyourroots®. Budi is not a person and will not pretend to be one. Budi can help you explore what you are good at and what you might do next, but is not a counsellor, social worker, medical professional or crisis service.

Transparency: At the start of your inyourroots® journey, you are told that if something you type suggests you may be at risk, a separate safety check will alert a member of our team for human review. Budi cannot replace a real person, and will always direct you to appropriate help.

If something you type suggests you may be at risk

A separate safety check runs independently of the conversational AI. When it identifies certain risk-related wording, the following sequence applies:

• Budi’s response includes information about real sources of help, including Samaritans, Shout, Childline, CEOP (for online safety concerns) and 999 where someone is in immediate danger.
• The conversation is marked in our records and placed in a longer retention category (see below).
• Our safeguarding lead is notified in HQ for human review, and receives a Slack alert in our private safeguarding channel.
• The DSL reviews the flagged concern and decides whether further action, support or referral is required — see human review step below.

Human review step

Important: Automated alerts are a detection tool, not a safeguarding decision. Every safety-flagged interaction is reviewed by a person. Budi’s automated crisis signposting does not substitute for that review.

On receiving a safeguarding alert, the DSL (Frankie Brookton) reviews the flagged concern and makes a decision on further action. Review timescales:

• Concerns suggesting immediate or serious risk: reviewed the same working day.
• Other flagged concerns: reviewed within two working days.

The review decision is recorded in the safeguarding log (see section 13). If the concern meets the threshold for referral — reasonable cause to suspect significant harm (Children Act 1989, section 47) — referral is made without delay regardless of any other factor, including whether the young person has been informed.

Automated checks may not identify every concern. If you are worried about yourself or someone else, do not wait for us to notice. Use one of the services in section 11.

Budi is designed not to provide specialist advice about self-harm, suicide, eating disorders, drugs or other matters that require a qualified professional. When those topics arise, Budi should explain its limit and direct you to appropriate help.

Online exploitation and grooming

If a concern relates to online exploitation, grooming or child sexual abuse material, the DSL will report it to CEOP (Child Exploitation and Online Protection Command), part of the National Crime Agency, at ceop.police.uk/safety-centre/ in addition to any other required action. CEOP is the specialist UK reporting route for these concerns.

What we keep and the legal basis for keeping it

Ordinary conversations with Budi are kept in the active conversation store for 30 days and then removed by an automated process that runs nightly at 03:30.

Conversations marked for safety reasons are retained for up to 12 months. The legal basis for this extended retention is:

• An appropriate Article 6 lawful basis is recorded separately for the actual safeguarding purpose; a special category condition is also required where the content reveals health or other special category information.
• Article 9(2)(c) UK GDPR may apply where processing is necessary to protect vital interests and the person is physically or legally incapable of giving consent. Immediate or serious risk alone does not establish that condition.
• Article 9(2)(g) UK GDPR with Schedule 1, Part 2, paragraph 18 of the Data Protection Act 2018 may apply where its specific safeguarding requirements are met, including necessity, substantial public interest and the specified reason for processing without consent. For adults, the statutory at-risk criteria must also be met. It is not automatically applicable to every safety-flagged conversation.

The 12-month period is provisional and is under review with a data-protection professional. Retention periods are assessed against necessity and proportionality on a case-by-case basis, not applied as a blanket rule to every flagged conversation.

We have not used anyone’s conversations to train or fine-tune an AI model. We will not start during the pilot. Any future change would require a fresh assessment, clear notice and appropriate explicit opt-in.

These protections apply automatically:

• Nothing you create is intentionally shared with an employer automatically. Sharing must be a deliberate action using the controls available at the time.
• Recording is optional. You can receive strengths, industry and role suggestions without recording video.
• We do not use your strengths profile for targeted advertising or sell access to your private information.
• Approximate location, age, health, disability, accessibility and neurodivergence information are classified as blocked from career-match calculations.
• Age-based restrictions on employer access to recordings are still being tested and are not yet presented as a verified guarantee.

Confidentiality and what we can promise

Important: We cannot promise to keep everything you tell us confidential. If what you share suggests you or someone else may be at risk of significant harm, we have a legal and ethical duty to take action — which may include sharing information with statutory services. Where it is safe to do so, we will tell you what we are doing and why.

If something raises a safeguarding concern, we assess the circumstances rather than automatically contacting a parent or carer in every case. Our decision takes account of the level of risk, your wishes, your safety, and our legal responsibilities. Where the concern involves a parent or family member as the source of potential harm, we will not contact that parent without first seeking advice from children’s social care. A decision to contact a parent will never delay a statutory referral where the threshold for referral has been met. Where appropriate, we will tell you what we are doing unless doing so could increase the risk.

An optional part of the journey may ask about focus, sensory needs, communication and what helps you work at your best.

• You can skip it or stop partway without losing access to the rest of Budi.
• The answers are classified as blocked from career-match calculations.
• They are not intentionally included in information shown to an employer unless you separately and deliberately choose to share relevant information.
• We use the information to make the experience more supportive, not to diagnose or label you.

We have built a privacy gateway designed to return only permitted matching information. Its current coverage across all live matching routes remains to be confirmed. We therefore describe this as our maintained classification and intended design control — not as a complete audited guarantee for every current result.

Everyone using interactive or community features must follow our code of conduct:

• No bullying, harassment, hate speech or intimidation
• No sexual content or sexual messaging
• No sharing personal contact details in public spaces
• Respect boundaries, privacy and consent

If someone breaks these rules, we may remove content, restrict features, suspend accounts or take other steps to keep people safe.

Reporting something

The confirmed route for reporting a safeguarding concern is email. Contact Frankie Brookton, Designated Safeguarding Lead (until a dedicated person is appointed), at frankie@inyourroots.com. We aim to acknowledge safeguarding emails within one working day. We do not claim that an in-product reporting button is available unless it is shown in the version of Budi you are using.

If someone is in immediate danger, call 999.

If the Designated Safeguarding Lead is unavailable

No Deputy DSL is currently appointed. If Frankie Brookton cannot be reached and a concern cannot wait, do not delay. Use the bypass procedure below.

“Unavailable” means: unreachable by phone and email for a period the concern cannot wait — for example, unable to make contact within one hour during working hours, or at all outside them.

If the DSL is unavailable and the concern is urgent:

• Contact the NSPCC professional helpline: 0808 800 5000. This line is specifically for professionals and volunteers who need to consult on a concern, including when a DSL is unavailable. Available Monday to Friday 10am–4pm.
• Contact the relevant local children’s services (MASH) directly using the details in section 11.
• If the concern relates to online exploitation or grooming, report to CEOP at ceop.police.uk/safety-centre/
• If the concern involves a young person in a school, college or partner setting, contact that organisation’s own Designated Safeguarding Lead.
• If someone is in immediate danger, call 999.

When the bypass is used:

• Record immediately: the nature of the concern, the steps taken, the agency or service contacted, the time the DSL was found to be unavailable, and the time of the bypass action.
• Notify the DSL within 24 hours of the bypass being used, or as soon as they are available, whichever is sooner.
• Enter the full record in the safeguarding log (section 13).

A deputy safeguarding lead or external safeguarding consultant will be appointed as the team grows. See section 12 for the current position and our plan.

If recording features are available:

• Recording is optional. Our policy is not to reduce a match score because someone chooses audio, does not show their face or does not record.
• The notice shown before recording should explain what is saved and for how long.
• Practice-recording deletion controls are still being tested. The recording notice should explain the applicable storage and deletion period.
• A saved pitch is intended to remain private until you deliberately share it.
• You may withdraw a share, but withdrawal cannot make a recipient forget something already viewed. We do not promise that every recipient is technically incapable of copying or screen-recording shared media.

We aim to work only with employers and partners that share our values and follow our safety rules. Where appropriate, we may:

• Carry out identity and business verification
• Ask for safeguarding assurances and evidence of relevant training
• Require background checks, including DBS checks, where the role or setting requires them

An employer should receive only the information you have deliberately shared using the controls available. Everyone receives three picks per day. When you choose an employer and permit selected profile content to be shared, that employer can see the interest/profile card before accepting. “Yes, let’s talk” opens communication inside Budi, which you start. In-app communication flags concerns; either side can unmatch or withdraw. The precise effect of withdrawal on existing media access and retained messages remains to be recorded and tested. Health, disability, accessibility and neurodivergence information is not intended to be included by default.

We set out employer conduct, confidentiality and onward-sharing requirements in the relevant employer or partner terms. Technical access controls are kept under review and are not a substitute for those obligations.

DBS checks and regulated activity

DBS checks are required where a role involves regulated activity with children or adults at risk under the Safeguarding Vulnerable Groups Act 2006 and the Protection of Freedoms Act 2012. “Regulated activity” with children includes teaching, training, instructing, caring for or supervising children, and providing advice or guidance on their physical, emotional or educational wellbeing, on a frequent, intensive or overnight basis.

• Frankie Brookton (DSL): the appropriate level of DBS check (including children’s barred list check where regulated activity applies) is being confirmed with reference to Frankie’s specific role, including any direct in-person contact with under-18 users at events. This will be documented and updated in the next policy review.
• Freelancers with access to under-18 personal data or any direct work with young people: DBS check required at the level appropriate to the role before work commences. Level to be confirmed with reference to the specific duties involved.
• T Level and work experience placements: supervised at all times when in contact with young people’s data or with users. Supervision arrangements and any DBS requirements are agreed before the placement begins.
• Employers listed on the platform: employers whose roles involve direct, unsupervised contact with young people aged under 18 in a regulated activity context must provide evidence of appropriate DBS clearance before being listed.

Where there is uncertainty about whether a role involves regulated activity, we take advice before the person begins work or has access to young people’s data.

If we run events, workshops or mentoring:

• Each session will have ground rules and a named person to speak to.
• In a school, college, youth service or other host setting, that organisation’s safeguarding arrangements and designated lead apply, and we work under them.
• We take steps to keep one-to-one interactions safe, including using appropriate venues, involving a parent or carer where appropriate, or using secure online tools.
• We ask what participants need to feel comfortable, including accessibility adjustments.
• Before a session begins, inyourroots® and the host agree the DBS, safeguarding-training, supervision and reporting requirements for everyone involved. Anyone whose role requires evidence of a particular check or training must provide it before carrying out that role.

No concern is too small.

If you report something:

1. We listen and take you seriously.
2. We assess the risk, record what is necessary and decide what action is needed and how quickly.
3. We support you and keep you informed where we can.
4. Where someone may be at risk of harm, we refer to an appropriate service. This may be children’s social care, the police, emergency services, or the young person’s school or college.

We only share information when necessary to protect someone from harm or meet a legal responsibility. Where appropriate, we will explain what we shared and why unless doing so could increase the risk.

When we must refer to statutory services

The statutory threshold for referral to children’s social care is set by the Children Act 1989, section 47: there must be reasonable cause to suspect that a child is suffering, or is likely to suffer, significant harm. Where this threshold is met, we refer without delay. We do not require proof of harm — reasonable cause to suspect is sufficient and required.

A second, lower threshold exists under section 17 of the Children Act 1989: a child who is “in need” of services to safeguard or promote their welfare, even without suspected harm. We assess whether lower-level concerns warrant a section 17 referral or another form of support.

For concerns involving criminal offences against a child — including online grooming, exploitation, or child sexual abuse material — we refer to the police and/or CEOP. Where there is immediate risk to life, we contact emergency services (999) first.

If your concern is about us

Frankie Brookton currently acts as the Designated Safeguarding Lead. There is currently no deputy. If a concern involves the Safeguarding Lead or anyone working with us, you do not have to report it to us first. You can contact the relevant local authority children’s services, the NSPCC (0808 800 5000) or the police directly using section 11. The bypass procedure in section 6 also applies.

For a non-emergency police matter, call 101. If someone is in immediate danger, call 999.

Prevent — radicalisation and extremism

Radicalisation — the process by which a person comes to support terrorism or extremism — is a safeguarding concern. Under the Counter-Terrorism and Security Act 2015, specified public authorities (including schools and colleges) have a duty to have due regard to the need to prevent people from being drawn into terrorism.

inyourroots® is not a specified authority under the Prevent duty, but we take radicalisation seriously as a safeguarding risk, particularly given that our platform serves young people aged 16–25 and we partner with schools and colleges that are specified authorities.

If a concern arises that a young person may be at risk of radicalisation:

• Do not challenge the individual directly or alert them that a referral is being considered.
• The DSL assesses the concern and, where appropriate, contacts the local Prevent coordinator via the local police or local authority.
• The national referral route is through local police (101 for non-emergency) or the ACT — Action Counters Terrorism — helpline for professionals.
• Where there is an immediate terrorist threat, call 999.

Any Prevent referral is handled with the same confidentiality standards as other safeguarding referrals and recorded in the safeguarding log.

If someone is in immediate danger, call 999.

Our safeguarding contact

Designated Safeguarding Lead: Frankie Brookton (until a dedicated person is appointed). Email frankie@inyourroots.com. We aim to acknowledge safeguarding emails within one working day. We are not a 24-hour service. If you need help now, use one of the services below.

UK support services for young people

• Childline — call 0800 1111. Free support for children and young people under 19, 24 hours a day, 7 days a week. childline.org.uk
• Samaritans — call 116 123 free, any time, day or night. samaritans.org
• Papyrus HOPELINE247 — call 0300 102 2470 or text HOPE to 88247. Support is available 24 hours a day. papyrus-uk.org
• Shout — text SHOUT to 85258 for free, confidential, 24-hour UK text support. giveusashout.org
• The Mix — call 0808 808 4994 for support for people under 25, or check its website for current support options and opening times. themix.org.uk
• CEOP — report online sexual exploitation, grooming or child sexual abuse material. Part of the National Crime Agency. ceop.police.uk/safety-centre/

NSPCC — for adults and professionals

• NSPCC helpline (public): 0808 800 5000 — adults worried about a child. Currently 10am–4pm Monday to Friday. Email help@nspcc.org.uk. nspcc.org.uk
• NSPCC professional helpline: 0808 800 5000 — for professionals and volunteers who need to consult on a safeguarding concern, including when a DSL is unavailable. Monday to Friday 10am–4pm.

Internet Watch Foundation

If illegal online content — including child sexual abuse material — is ever discovered or reported in connection with the platform, report it to the Internet Watch Foundation at iwf.org.uk. This is the UK body for reporting and removing this content.

Local children’s services (MASH)

Verify these numbers are current before use — MASH contact routes can change. These are the correct local authority numbers as at the date of this policy.

• Essex: 0345 603 7627 — Monday to Thursday 8:45am–5pm; Friday 8:45am–4:15pm. Out of hours and bank holidays: 0345 606 1212. Essex County Council
• Hertfordshire: 0300 123 4043 — available 24 hours a day. Hertfordshire County Council
• Suffolk: 0808 800 4005 — available 24 hours a day. Suffolk County Council

Opening hours and contact routes can change. If a listed service is unavailable and the risk is urgent, contact the police or the relevant local authority children’s service.

inyourroots® is in an early stage and some features are being developed or tested.

Current limitations include:

• The automated typed-risk check and crisis signposting are live. Flagged concerns notify the safeguarding lead in HQ for human review, with an additional Slack alert in the private safeguarding channel. The DSL reviews flagged concerns within the timescales set out in section 3. Alerts do not mean the service is monitored 24 hours a day.
• There is currently no Deputy Designated Safeguarding Lead. The bypass procedure in section 6 is the confirmed route for urgent concerns when the DSL is unavailable.
• We are in the process of identifying an external safeguarding consultant who can act as an advisory deputy DSL when Frankie is unavailable. This is a priority action for the launch period.
• Safeguarding concerns are currently accepted by email. An in-product reporting button is not presented as available unless it appears in the version being used.
• Mentoring and community features may not yet be live.
• Practice-recording deletion, employer recording-access/download controls and under-18 access restrictions are still being tested. We will not describe these controls as fully verified until testing is complete.
• The current coverage of the matching privacy gateway across live matching routes remains to be confirmed.
• Some employer and partner checks may be manual during the pilot.

We will not present a planned control as live until it has been verified. If you are unsure whether a feature is available or how we protect it, ask us and we will explain the current position.

A safeguarding log is maintained by the DSL. The log is separate from ordinary Budi conversation data and is stored securely with access restricted to the DSL and any authorised deputy or consultant.

What the log contains

• Date and time the concern was identified or reported
• The nature of the concern (summary — not the full conversation text where not necessary)
• Whether the concern was identified by automated flag, direct report, or other means
• The DSL’s risk assessment and decision
• Action taken: referral made, support offered, concern noted but not escalated, or bypass procedure invoked
• Agency or service contacted, if applicable, and the response or outcome
• Date the DSL was notified (including where the bypass procedure was used)
• Any further follow-up actions and dates

How long records are kept

Safeguarding concern records are retained for the longer of:

• Until the young person’s 25th birthday (if the concern involved a person under 18 at the time); or
• Six years from the date the concern was recorded.

Where a concern resulted in a statutory referral, records are retained for as long as necessary to support or evidence that referral, which may be longer than the standard period. The retention period is reviewed at the point of closure of each case. This is our current proposed case-record schedule, not a universal statutory requirement; its necessity and proportionality remain subject to professional review.

Safeguarding records are not subject to the standard 30-day or 12-month Budi conversation retention rules. They are maintained under the DSL’s authority and in accordance with this policy.

We review this policy at least once a year, and sooner if a feature, partnership, incident, legal requirement or safeguarding practice changes. We use feedback, evidence from incidents and near misses, and current professional guidance to improve it.

The 12-month retention period for safety-marked conversations and the referral approach will be reviewed with an appropriate data-protection or safeguarding professional.

The Designated Safeguarding Lead maintains safeguarding knowledge and training appropriate to this platform’s stage of development and to the responsibilities of the role. Training currency is reviewed annually. A training record is maintained internally.

This policy is prepared with reference to the following legislation and guidance:

Inyourroots Ltd · Company number 17285309 · Suite A82, James Carter Road, Mildenhall, IP28 7DE · frankie@inyourroots.com · ICO registration ZC244626