Privacy Policy

Locum1st (“we”, “us”) is operated by Y Healthcare Services LTD, a company registered in England and Wales (company number 17014317) with its registered office at Studio 3, Jackson House, Sibson Road, M33 7RR. We are the data controller for the personal data described in this policy. You can contact us about data protection at [email protected]. Our registration with the Information Commissioner’s Office (ICO) is in progress; our registration number will be published here once it has been issued.

Locum1st is a work-management service for UK locum pharmacy professionals: shift tracking, mileage logging, invoicing, professional verification, and a marketplace for available shifts. This policy covers the Locum1st website at locum1st.net and the Locum1st mobile apps.

• Account data — name, email address, and password (held by our shared sign-in service; passwords are stored hashed and are never visible to us).
• Profile data — date of birth, phone number, home address, professional role, GPhC registration number, independent prescriber status, and (optionally) company details.
• Bank details — account name, sort code, and account number, which you provide so they can appear on invoices you generate. We do not take payments from this account.
• Verification documents — documents you upload to verify your identity and professional standing, which may include photo ID, right-to-work evidence, DBS certificates, indemnity insurance documents, and professional certificates.
• Work records — shifts, mileage journeys, expenses, invoices, and related notes you record in the service.
• Messages — messages you exchange through the in-app messaging and invoice inbox features.
• Payment data — if you subscribe to Pro on the web, payment is handled by Stripe; we store a Stripe customer reference, not your card details. On iOS, subscriptions are handled by Apple and we receive only a receipt confirming your subscription status.
• Device data — if you use the app anonymously before creating an account, a random device identifier is generated to keep your data together.
• Telegram linking — if you choose to link the optional Telegram bot, we store your Telegram chat identifier.

• Providing the service (contract) — operating your account, storing your shifts, mileage, expenses, invoices, and messages, and generating documents you request.
• Verification (contract and legitimate interests) — reviewing the documents you upload so that pharmacies using our marketplace can rely on your verified status. Where a document reveals information about criminal convictions (for example, a DBS certificate), we process it only where necessary for professional or occupational requirements, in accordance with Article 10 of the UK GDPR and an applicable condition in Schedule 1 of the Data Protection Act 2018. We maintain an appropriate policy document, restrict access to authorised reviewers, and retain this information only for as long as verification is relevant.
• Marketplace (contract) — sharing relevant details of your application (name, verified status, rate) with the pharmacy or agency whose shift you apply for.
• Payments (contract and legal obligation) — managing your subscription through Stripe or Apple.
• Service emails (contract and legitimate interests) — sending invoices you ask us to send, password resets, and important service notices.
• Security and error monitoring (legitimate interests) — keeping the service secure and fixing faults.

We do not sell your personal data and we do not use it for third-party advertising.

We use the following processors and service providers:

• Stripe — subscription payments on the web.
• Apple — subscription payments on iOS.
• Resend — sending and receiving service and invoice emails.
• Amazon Web Services (S3) — encrypted storage of verification documents and receipts.
• Google Maps Routes API — calculating driving distances for mileage entries (pharmacy and home addresses are sent to Google for this purpose).
• Self-hosted infrastructure — our application, database, and real-time messaging servers are hosted on infrastructure we control, located in the European Union.
• Telegram — only if you link the optional Telegram bot.
• Staff1st and data1st — first-party services operated by Y Healthcare Services LTD in the 1stAppSuite. Staff1st provides marketplace shift and pharmacy workflows, while data1st provides pharmacy statistics. We share only the information needed to provide the feature you use.

Where a provider processes data outside the UK, transfers are protected by an adequacy decision or appropriate safeguards such as the UK International Data Transfer Addendum.

• Account and profile data — for as long as your account exists.
• Work records (shifts, mileage, expenses, invoices) — for as long as your account exists; you can delete individual records at any time.
• Verification documents — while your account exists and verification remains relevant; deleted when your account is deleted.
• Financial records we are required to keep (e.g. subscription transactions) — up to 6 years to meet legal obligations.

You can delete your account at any time from the Account screen in the app or on the web. Deletion removes your profile, work records, messages, and verification documents from our systems.

Under the UK GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased;
• restrict or object to certain processing;
• receive your data in a portable format; and
• withdraw consent where processing is based on consent.

To exercise any of these rights, contact [email protected]. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk.

Data is transmitted over encrypted connections (HTTPS) and stored on access-controlled infrastructure. Verification documents are stored in a private storage bucket and are accessible only to you and to our verification reviewers. Access to production systems is restricted to authorised personnel.

Locum1st is a professional tool for registered pharmacy professionals and is not intended for anyone under 18.

We will post any changes to this policy on this page and, for significant changes, notify you by email or in the app.