Locumwise privacy policy

The app, and the website at locumwise.co.uk

Last updated 11 November 2026

Who we are

Locumwise is made and run by Dr Michael Howes, a GP, who is the data controller for what is described here. You can reach us at [email protected], or with Contact us inside the app.

We are registered with the Information Commissioner’s Office, registration number ZC284876.

Two ways to use it

On its own, with no account

You never have to sign in. Your name and address, bank details, National Insurance, GMC and NHS Pension numbers, date of birth, signature, the practices you work at, every session, fee, distance and expense are stored in the app’s own storage on your phone. None of it is sent to us. If you lose the phone or delete the app, it’s gone unless you made a backup to a file.

Signed in with sync

If you sign in, the app also keeps your records on our server. That’s what lets you use the website, keeps a second copy safe if your phone is lost, and lets a change on one show up on the other. Signing in is optional and you can stop at any time.

What we hold when you have an account

• Your email address. It’s how you sign in. We email you a six-digit code; there is no password. On a computer you can sign in instead by scanning a code with the app on your phone (see Signing in on a computer with your phone).
• Your records. Sessions and fees, practices and their addresses and email addresses, invoices and credit notes (with their numbers, lines and dates), the log of pension forms you have made and sent, other work, expenses, mileage, your name, address and phone number, your tax and pension settings, session shortcuts and your email template.
• Your plan. When your free trial started, and what you have bought (see Payments below).
• Your starter plan, if you make one. The answers you give (when you start, sessions a week, your rate, weeks worked, expenses, any salary, your student loan plan, and your pension and Self Assessment choices), the checklist items you have ticked, your email choices, and the reminder emails it has scheduled, with their wording and the dates they go out. Amounts are left out of those emails unless you ask for them.
• Your booking link (if you use it). The days you mark free, what a morning, afternoon and whole day mean for you and what you charge, how far ahead practices may book, the name and message practices see, each version of your booking terms, which practices may book you straight away, and the requests and bookings that come in, with what each practice gave us (see Practices booking you).
• Where you are signed in. For each phone and browser signed in to your account: when it signed in, when it was last used, and the name it gives itself (such as “Chrome on Windows”). It is how sign-in works, and you can see the list and sign any of them out from your phone or the website.
• Your phones, if you turn on booking notifications. For each phone, the code Apple or Google gives it so a notification can reach it, and whether it is an iPhone or Android. It goes when you sign out on that phone, or when Apple or Google tell us the app is no longer there.
• Emails we send for you, if you turn it on. Whether it is on, the address copies and replies go to, and, for each email sent, who it went to, its subject, which invoice and Form As it carried and when. Never the message or the documents themselves (see Sending emails for you).
• Invoice numbers. We keep the numbers each of your devices has been given, so two devices never issue the same one.
• A device ID. A random code your phone or browser makes for itself, sent with each request, used only to keep those invoice numbers straight.

What is locked, and what isn’t

These are locked (encrypted) on your device before they are sent, and we can’t read them:

• your bank account name, account number and sort code, including the copy inside each invoice
• your National Insurance number and date of birth
• your GMC number and NHS Pension membership number
• your drawn or typed signature

The key stays on your devices, kept in your phone’s secure storage, and never comes to us. When you first sign in the app gives you a recovery code to keep somewhere safe. If you lose every device and the code, we can’t get these details back for you, and you would type them in again. The rest of your records are not locked in this way, because the service has to work with them, and they are what you need to keep for your tax records. The starter plan is not locked either, because our server sends its reminder emails. They are encrypted in transit and at rest by our hosting provider, and each account can only read its own.

There is one exception, and only if you choose it. If you use “Send for me”, the invoice and Form A you send are made readable on your device and pass through our server and our email provider, Resend, to reach the practice. That includes the bank details and NI number printed on them. We don’t store the documents. Resend keeps each email for 30 days. Sending from your own email app instead keeps them off our server.

The website shows the locked details only once the browser holds your key. It gets it in one of three ways: it makes the key itself when you start on the website, you type your recovery code, or you pair it with your phone by scanning a code shown on the site. When pairing, the key is passed from your phone to your browser in a form only that browser can open; it never passes through us in a readable state.

Who else handles it

We use a small number of services to run this. Each is told only what it needs, and none uses it for its own purposes.

Where your information goes

UK law lets personal data go to another country only under a recognised safeguard. Here is where each service handles it, and the safeguard it relies on.

You can ask us for a copy of the contractual terms we rely on for any of these, at [email protected].

Payments and your plan

Everything is free for your first 90 days. After that, the diary, invoices, expenses, mileage and statements are free, and Locumwise Pro is a paid subscription. In the app the store (Apple or Google) takes the payment. On the website Stripe does. Either way, your plan is recorded against your account so it works on both. We never see or keep your card number.

The new locum starter plan is free with an account. If you set it up before you start locum work, with a start date within six months, you get 90 days of Locumwise Pro from your start date, added to your account on that day. It needs no card and does not renew. A starter plan bought before 8 November 2026 keeps its twelve months of GP Locum Pro.

Looking things up

A few features ask an outside service a question. Each request is an ordinary web request, so the service sees your IP address. None is sent your name, your diary, your fees or your documents, or any ID for you.

• Finding a practice. The name or ODS code you type goes to the NHS Organisation Data Service, so the address and ODS code can be filled in. A practice booking a locum can use the same search on the booking page.
• Finding an employing authority code. This is searched in a list of employers we keep inside the app and the website. Only if nothing matches, the practice name or postcode may be sent to the NHSBSA employer lookup.
• Working out mileage. Your home postcode and your practices’ postcodes are sent to postcodes.io, which returns their coordinates. With Locumwise Pro, the coordinates of home and each practice are then sent to the OpenRouteService routing service run by HeiGIT, in the EU, which returns driving distances. Postcodes and coordinates are the only things sent. A postcode is still personal data, which is why it is written down here.

Documents, calendar and messages

• Documents. Invoices, Form As, Form Bs and statements are made as PDF files on your phone or in your browser. They go somewhere else only when you send them, through your phone’s share sheet or your own email. We aren’t told where they went.
• Calendar. The app can add your sessions to your phone’s calendar, if you switch it on and allow it. It doesn’t read your other appointments, and nothing about your calendar leaves the phone.
• Calendar link (website, optional). If you switch it on, the website makes a private web address for your account, and your calendar (Google, Apple or Outlook, whichever you choose) fetches your sessions from it and keeps a copy. Each entry has the practice, its address, the session description and the times, and never fees, invoices or pension details. Anyone who has the address can see that, so treat it like a password. You can replace it, which stops the old one working, or turn it off, on the same page. Your calendar provider looks after its copy under its own policy. Deleting your account ends the link. Nothing about it is sent anywhere unless you switch it on.
• Contact us. The name, email address and message you send, and the app version so a bug can be placed, reach us by email. We use them only to answer you, keep them for up to 12 months after the conversation ends, and never add you to a mailing list.

Practices booking you

This section is for locums who use a booking link, and for practices who book through one.

What a booking page shows

A locum’s booking page shows only what they chose to show: the name they gave, their message, what a session involves, their booking terms, the dates they have marked free, and their fees if they chose to show them. It never shows their other work, where they are on other days, their address or their contact details. Anyone with the link can see it, so a locum can make a new link at any time, which stops the old one working, or turn it off. A practice given its own instant booking link can book without waiting; the locum can stop that link whenever they like.

What a practice gives us

To ask for or make a booking, a practice gives its name, practice code and address, a contact’s name, email address and phone number, the dates and sessions it wants, any message, and its agreement to the locum’s terms. We keep which version of the terms it agreed to, and when, because that is the record of what was agreed.

What it is used for

• To pass the request or booking to the locum, who decides whether to take it.
• To send that booking’s emails: confirming the email address, the request being sent, the answer, any change or cancellation, and a calendar file. A reply to one of them goes to the other side.
• If the locum accepts, the practice is added to the locum’s list of practices, and the sessions to their diary, so they can invoice the practice and fill in its pension forms, as for any practice they work for.

A practice’s details are never used for anything else: no mailing list, no marketing, and nothing passed to anyone other than the locum it is booking.

Who is responsible

A locum decides which bookings to take and keeps them with the rest of their records, so they are responsible for them, as they are for the practices and sessions they add themselves. We hold and send booking details on the locum’s behalf, and use a practice’s email address ourselves only to check it works before a request is sent. A practice wanting to see, correct or remove what it gave can ask the locum, or write to [email protected] and we will pass it on and help.

How long it is kept

• A request whose email address is never confirmed goes no further after a day, and is deleted with the others below.
• A request that never became a booking (declined, withdrawn, not answered in time, or taken by another booking) is deleted 12 months after its date.
• A booking that was made, including one later cancelled, is kept with the locum’s records for as long as they keep their account, because it is the record of what was agreed and what any cancellation fee turns on.

Sending emails for you

If you are signed in, the app and website can email an invoice and its Form A to the practice for you, instead of you sending them from your own email. It is off until you turn it on, and you are asked the first time.

• Your phone or browser makes the documents, as it always does, and sends them to our server, which hands them straight to Resend to deliver. They pass through us readable, including the bank details and NI number printed on them, and we don’t store them. Resend keeps each email, with its attachments, for 30 days.
• The email comes from our address, under your name (“Dr Jane Smith via Locumwise”). Replies go to you, and a copy is sent to you. That address is the one you sign in with, or another you confirm with a code we email to it, so nobody can have copies sent to an address that isn’t theirs.
• For each email we keep who it went to, its subject, which invoice and Form As it carried, when, and Resend’s reference for it: so you can be sure it went, to limit how many go in a day, and to answer a practice that says nothing arrived. We delete these records after 13 months, and with your account.
• You can turn it off at any time, under Account on the website or Practice email in the app. Sending from your own email app keeps the documents off our server altogether.

Signing in on a computer with your phone

On locumwise.co.uk you can sign in by scanning a code with the app on your phone, instead of an emailed code.

• While the code is on screen (three minutes at most), we hold the computer’s one-time public key, the name its browser gives (such as “Chrome on Windows”) so your phone can show you what is asking, and whether you said it is a shared computer. Your phone shows you this before you approve.
• When you approve, your phone locks your key to that computer so only it can open it, as pairing does: it passes through us unreadable. We make a one-time sign-in for your account, handed only to the computer that asked, and then delete the request.
• On a shared computer, the sign-in and your key are kept only for that browser tab, so closing it signs you out, and the website signs out by itself after 30 minutes unused. Nothing is left on the computer.
• Only approve a code on a computer in front of you, at locumwise.co.uk. You can see every phone and computer signed in, and sign any of them out, from your phone or the website.

Adding your phone from the website

If you started on the website, Account there can show a code that signs the app on your phone in to your account when you scan it, and unlocks your bank details and identity numbers on the phone.

• While the code is on screen (five minutes at most), we hold a request under your account. When your phone scans the code we add your phone’s one-time public key and the name it gives (such as “Locumwise on iPhone”), so the website can show you what scanned it. The phone is shown part of your email address, so you can check it is your account.
• Both screens show six digits. Only when you confirm on the website that they match does the website lock your key to your phone so only it can open it: it passes through us unreadable. We make a one-time sign-in for your account, handed only to the phone that scanned the code, and then delete the request.
• Part of the code never leaves your screen and your phone’s camera, so we can’t answer in your phone’s place or swap in a key of our own.
• Only scan a code on a screen in front of you, at locumwise.co.uk, and say No on the website if your phone shows different digits or none.

No analytics, tracking or ads in the app; the website counts visits

The app contains no analytics, advertising, tracking or crash-reporting service. It doesn’t read your advertising ID, and it doesn’t measure how you use it. The one thing we look at is when an account was last used, so that accounts nobody uses can be deleted (see How long we keep it).

The website uses Cloudflare Web Analytics to count visits and which pages are read, and, if you followed a link to get here, roughly where from. It works without cookies or any other identifier stored in your browser, and without fingerprinting: it can’t tell one of your visits from another’s, and it can’t follow you to another website. What we see is aggregate counts, not a record of what you personally looked at. There is no advertising, and nobody else’s tracking runs on this site.

Separately, and only to keep you signed in, the website stores your sign-in in your browser’s own storage, and, if you have paired it, the key to your locked details. That isn’t a cookie and isn’t shared with Cloudflare or anyone else. Signing out removes both. If you arrive from the starter plan questions on GP Finance Tools, your answers are kept in the same storage until you sign in and they are saved to your plan.

How long we keep it

Your account and records stay until you delete the account, or until it has gone unused for two years. If it has, we email you about a month before, saying the day it will be deleted; opening the app so it syncs, or signing in on the website, before then keeps it. An account with a subscription that has not ended is not deleted this way. Deleting removes everything from our server straight away. Copies in the database’s own rolling backups can survive for up to 7 days more, and then go. A subscription record kept by RevenueCat, and what Stripe and the stores must keep about a payment, are held by them under their own rules and financial record-keeping duties. Messages you send us are kept for up to 12 months. How to delete your account is on the deleting your account page.

Why we’re allowed to use it

Under UK GDPR, we use your records because you asked us to provide the service (a contract). We use messages you send us because it’s in our legitimate interest to answer someone who has written in. A practice’s booking details are used to arrange the booking it asked for with the locum, and we check its email address works because it is in everyone’s legitimate interest that booking emails reach the right person. We don’t use your information for anything else.

We don’t make decisions about you by automated means, and we don’t profile you. The tax and pension figures the app shows are worked out from what you enter, for you to use. Nothing is decided about you from them.

Your rights

You can ask to see, correct, delete or take a copy of what we hold about you, and to object to how it is used. Most of it you can do yourself: the website’s Account page has Download my records, which gives you a copy of everything on the server, and the account can be deleted there or in the app. For anything else, write to [email protected] and we’ll reply within a month. If you’re unhappy with how a request is handled, you can complain to the Information Commissioner’s Office.

Children

Locumwise is a professional tool for doctors. It isn’t aimed at anyone under 18.

Changes to this policy

If the app or the website starts to do something with your information that this page doesn’t describe, we’ll update this page before that version is released, and the date at the top will change.

Questions

Email [email protected], or use Contact us inside the app.