Set ethics and privacy boundaries

Service research involves people who may need access and assistance more than a team needs their personal data. Before recruiting, state why each question is asked, which information is needed, how long material is retained and who sees the raw record. Asking for every file to understand a journey is not a research plan; use the least record that tests the hypothesis, such as a handoff time and status instead of an identity document. Service use does not imply consent to research. Explain that declining will not change treatment and that reports will remove identifying detail. If that separation cannot be protected, change the method or refer the issue to the privacy owner before collection.

Consider power in an interview. When the person deciding eligibility sits with a participant, the participant may avoid criticizing a confusing step. A researcher independent of that decision could run the session, or the team could observe a task without personal details after understandable consent. Do not require secrets or harmful experiences merely to establish a service point. If a legal, security or other specialist need appears, the design adviser does not become an unauthorized provider; record and refer it through the organization’s approved route using only necessary information. This is a boundary of the commission, not universal legal advice; local implementation needs specialist review.

Fair inclusion affects validity. If research recruits only people who read the form language and own recent phones, it cannot support a digital-only recommendation for everyone. Ask who is missing and whether absence reflects a service barrier. Plan an assisted channel or understandable contact method and allow appropriate time. Describe a barrier in the service rather than labeling a person incapable. Use a participant code and record only access needs relevant to the task. Audio or video capture should not be automatic; if needed, explain its use, viewers and deletion before starting.

Compare lower-exposure alternatives: aggregate data instead of personal records, a synthetic task instead of a live file, or a test environment instead of altering the live service. State what each loses: a synthetic task can test wording but not performance under operational pressure; aggregate data may show channel differences but cannot explain an individual journey. Set a stop point if collection exceeds purpose or harms access, pause the affected activity and have the authorized owner decide a remedy. Calling data anonymous is insufficient if case details could reidentify someone. A recommendation must name evidence limits, the reviewer and specialist questions outside a design adviser’s authority.