Privacy Policy

Last updated: 24 November 2025

This Privacy Policy explains how LocumBooking (“we”, “us” or “our”) collects, uses, stores and protects personal information when you visit our website or use our services.

1. Who we are

LocumBooking provides a technology platform to help locums, practices, organisations and agencies manage locum bookings, rota planning, communication and compliance. For certain activities we act as an independent Data Controller, and for others we act as a Data Processor on behalf of our customers.

2. Information we collect

We may collect and process the following categories of information:

Account information: name, email address, contact details, password (stored in hashed form), job role, and account preferences.
Professional profile data: role (e.g. GP, pharmacist), qualifications, registration numbers, uploaded CV or profile details, organisation name, and relevant professional information.
Compliance and documentation data: information contained in documents you or your organisation upload to the platform, such as proof of identity, right-to-work evidence, DBS details, professional registration and training certificates.
Booking and rota data: information relating to bookings, shifts, sessions, locations, rates (where applicable) and associated communications.
Usage and technical data: IP address, device type, browser type, pages visited, time spent on pages, and other diagnostic data that helps us understand how the platform is used.
Communication data: messages and enquiries sent through contact forms or support channels.
Cookies and similar technologies: small data files used to remember your preferences, maintain sessions and support analytics.

3. How we use your information

We use personal information to:

Provide, operate and maintain the LocumBooking platform
Create and manage user accounts
Enable bookings, rota management and communication between approved users
Verify identity and support compliance processes
Respond to enquiries and provide customer support
Monitor and improve platform performance, usability and security
Generate aggregated, anonymised insights for product improvement
Meet legal, regulatory and security obligations

4. Legal bases for processing

We process personal data under the following legal bases, depending on the context:

Performance of a contract: to provide the platform and services you or your organisation have requested.
Legitimate interests: to operate and improve our services, maintain security and support customer relationships in a way that is proportionate and expected.
Compliance with legal obligations: to meet requirements under applicable laws, including record-keeping and regulatory requests.
Consent: for certain activities such as optional cookies or receiving non-essential communications, where required by law.

5. Sharing of information

We do not sell personal information. We may share personal data with:

Service providers: companies that provide infrastructure, hosting, security, analytics or support services necessary to operate the platform.
Customers and other authorised users: where necessary to deliver the service (for example, showing relevant profile details to a practice or agency managing bookings).
Professional advisers: such as lawyers, auditors and insurers, where reasonably necessary.
Regulators and authorities: where we are legally required to do so, or to protect our rights, users, or the public.

Where we use third-party service providers, they are bound by appropriate contractual and confidentiality obligations.

6. International transfers

Personal data may be processed in the UK, the European Economic Area (EEA) or other countries that provide an adequate level of data protection. Where data is transferred outside the UK or EEA, we implement safeguards such as:

Adequacy decisions issued by the UK or EU authorities
Standard Contractual Clauses (SCCs) or equivalent safeguards
Appropriate technical and organisational measures

7. Data retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including:

Providing and supporting the platform
Meeting legal, accounting or reporting requirements
Resolving disputes and enforcing agreements

When data is no longer required, it is deleted or anonymised in line with our data retention practices.

8. GDPR and UK GDPR compliance

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, where applicable, the EU General Data Protection Regulation (GDPR), as well as relevant local data protection laws in jurisdictions where we operate.

Depending on the situation, we may act as:

A Data Controller for account information, platform usage data and administrative records; and
A Data Processor when processing data on behalf of agencies, practices or organisations using LocumBooking for their own workforce management.

When acting as a Data Processor, we only process personal data based on the documented instructions of the Data Controller.

9. Your data protection rights

If you are based in the UK, EU or EEA, you have certain rights under UK GDPR / GDPR, which may include:

Right of access – to request a copy of personal data we hold about you.
Right to rectification – to request correction of inaccurate or incomplete data.
Right to erasure – to request deletion of your data in certain circumstances.
Right to restrict processing – to request that we limit how your data is used.
Right to object – to object to certain types of processing, including some profiling.
Right to data portability – to receive certain data in a structured, commonly used format and transmit it to another controller.
Right to withdraw consent – where processing is based on consent, you can withdraw it at any time.

To exercise these rights, please contact us using the details in the “Contact us” section below. We may need to verify your identity before responding.

You also have the right to lodge a complaint with your local data protection authority. In the UK, this is the Information Commissioner’s Office (ICO).

10. Data processing on behalf of agencies and organisations

When an agency, practice or other organisation uses LocumBooking to manage locums or staffing:

The organisation is typically the Data Controller.
LocumBooking acts as the Data Processor.
We only process personal data as necessary to provide the platform and related services.
We do not use such data for unrelated advertising or sell it to third parties.

A separate Data Processing Addendum (DPA) can be made available to customers who require it as part of their contractual arrangements.

11. Cookies and similar technologies

We use cookies and similar technologies to improve your experience, maintain sessions and understand how our website and platform are used. For more detail about the types of cookies we use and how to manage them, please see our Cookies Policy.

12. Information security

We implement appropriate technical and organisational measures to protect personal data, including:

Encrypted data transmission where appropriate
Secure hosting environments
Role-based access controls and authentication
Audit logs and monitoring
Regular back-ups and resilience measures

While we take reasonable steps to protect your information, no system can be completely secure. We cannot guarantee absolute security of data transmitted to or stored on the platform.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements or operational practices. The “Last updated” date at the top of this page indicates when it was last revised. We encourage you to review this page periodically.

14. Contact us

If you have questions about this Privacy Policy, our use of personal data, or would like to exercise your data protection rights, please contact:

Email: [email protected]