Privacy Policy

Locumo · Last updated 4 October 2026

Locumo (“we”, “us”, the “app”) is a tool that helps locum practitioners track shifts, manage practices, and create invoices. This policy explains what information we collect, how we use it, who we share it with, and the choices and rights you have. We only collect what we need to run the app for you. We do not sell your data and we do not use it for advertising.

Information we collect

We collect only the information you provide or create while using Locumo:

• Account details: your email address and a password. Your password is never stored in plain text; it is protected using industry-standard salted hashing (scrypt).
• Your work records: shifts (dates, times, pay, mileage and notes), the practices you work at (names, addresses, contact emails and rates), and the invoices you create.
• Your profile & invoice settings: details you enter for your invoices, such as your name, billing address, phone number, contact email, payment/bank details, invoice numbering, and your home address or postcode.
• Location text you enter: your home postcode/address and practice addresses, which are used only to estimate driving mileage. Locumo does not access your device’s GPS or track your location.
• Your expenses, if you use Finance: the expenses you record (date, description, amount, category and any notes), the names you give the bank accounts you import from, and any receipt photo or PDF you choose to attach. If you import a bank statement as a CSV file, it is read on your device and only the rows you confirm are saved; the rest of the file never leaves your phone. If you import a statement as a PDF, the document is sent to our server and read by our AI provider (see below) so that its transactions can be listed for you to review; only the rows you confirm are saved, and the PDF itself is not kept.

We do not use third-party analytics, tracking, or advertising SDKs, and we do not use any device identifier for tracking or advertising.

For accounts taking part in referrals, and only those, we also keep a small amount of information to check that a referral is genuine: a one-way hash of a random identifier generated for each installation of the app, and a one-way hash of the IP address the account was seen from. For an account that was referred, we also keep a one-way hash of the email address used, the referral code that was entered, and the date and store of its first Locumo Pro payment and whether that payment was refunded (payments are taken by Apple or Google; we never see card details). The email address, IP address and installation identifier themselves are not stored, only those hashes; the installation identifier is generated by us and is not connected to your device’s advertising identifier. This is used only to decide whether a referral earns its £5 voucher and to detect abuse, never for tracking or advertising. When a voucher is sent, we email the gift card code and keep only its last four characters. Each IP hash is deleted 90 days after it was last seen, the signup one 90 days after signup, and everything else is deleted with the account.

If you joined with a colleague’s referral code, that colleague can see your email address, the date you joined, and whether their voucher is pending, declined or successful. You are told this when you add the code. They never see which plan you chose or anything else in your account.

How we use your information

• To provide the core features of the app: storing your shifts, practices and invoices and syncing them across your devices.
• To create the invoices, summaries and exports you request.
• To estimate driving mileage between your home and a practice, when you ask for it.
• To authenticate you and keep your account secure.
• To send account-related emails you request, such as a password-reset link.
• If you choose to forward a booking-confirmation email to your personal Locumo import address, to read its content and, where we can do so with enough confidence, add it to your calendar automatically. We do not retain the email body beyond this processing. Only the subject line, sender address, and the outcome (e.g. that a shift was created) are kept, as an activity log you can review, for 90 days.

Connected calendars (Google and Microsoft)

If you choose to connect a Google Calendar or a Microsoft (Outlook) calendar, Locumo reads the events in the calendars you select so it can find work shifts you have booked and bring them into Locumo. This feature is optional, is off until you connect a calendar, and you can disconnect it at any time in Settings.

• What we access: the events in the calendars you choose to watch, including their title, location, description, organiser and start and end times. We request read-only access. We never create, edit, or delete anything in your calendar.
• How we use it: we look for events that appear to be work shifts, match them to the practices you have saved, and either add them to Locumo for you or list them for you to review. When an event is unclear, its text may be sent to our AI provider (Anthropic) solely to decide whether it is a shift and to read the practice name.
• What we keep: we do not store the contents of your calendar. We keep only what is needed to avoid importing the same event twice and to notice later changes: the event’s identifier, a one-way fingerprint (hash) of the fields that matter, and the shift records we create at your direction. Event descriptions and bodies are not retained.
• What we do not do: we do not read calendars you have not selected, we do not use your calendar data for advertising, we do not sell it, and we do not use it to train AI or machine-learning models.
• Disconnecting and deletion: disconnecting a calendar in Settings removes our access and deletes the stored access tokens. Deleting your account permanently removes all connection and calendar-related data.

The same applies if you import from your device’s own calendar (Apple Calendar in the iPhone app, or your phone’s calendar in the Android app). With your permission, the app reads events from the calendars you choose on your device and sends their text (title, times, location and notes) to our server so it can recognise work shifts, with unclear events checked by our AI provider (Anthropic) in the same way as above. This processing is quota-limited, is never used for advertising, and the event text is not kept beyond the activity log described above. Turning the import off, or withdrawing calendar access in your device settings, stops it entirely.

Google API Services User Data Policy

Locumo’s use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google Calendar data only to provide and improve the calendar-import features described above, we do not transfer it to others except as necessary to provide those features, we do not use it for serving advertising, and we do not allow humans to read it except with your consent, for security purposes (such as investigating abuse), or where required by law.

Service providers we share data with

We use a small number of trusted providers to operate the app. They process your data only to provide their service to us, under their own privacy and security terms:

• Vercel: application hosting, and private file storage for any receipt you attach to an expense. Receipts are stored privately, are only ever served to your signed-in account, and are deleted when you remove them or delete the expense or your account.
• Turso: secure database storage for your account and records.
• Resend: sending transactional emails (e.g. password resets), and, if you use the email-forwarding import feature, receiving the emails you forward to your personal import address so we can read their content. Resend’s own retention of that content is governed by their own terms, separately from Locumo’s. See the note above on what we ourselves keep.
• Google: if you connect a Google Calendar, providing read-only access to the calendar events you select so we can detect shifts. We access only the calendars you choose and never write to them.
• Microsoft: if you connect an Outlook calendar, providing read-only access to the calendar events you select so we can detect shifts. We access only the calendars you choose and never write to them.
• Anthropic: our AI provider. When a forwarded booking email, a connected-calendar event, or a device (Apple) calendar event is unclear, its text is sent to Anthropic solely to decide whether it is a shift and to read the booking details. If you import a bank statement as a PDF, that document is sent to Anthropic solely to transcribe its transactions, and if an expense from your statement cannot be categorised by Locumo’s own rules, the payee name (never the amount, date or your account details) may be sent to suggest a category. All of this automated processing is quota-limited, is used only for that purpose, is not used to train models or for advertising, and nothing sent is retained by us beyond the activity log described above. Not forwarding emails, not connecting or importing a calendar, and not importing a PDF statement means nothing is ever sent.
• OpenRouteService: converting the addresses you enter into approximate driving distances for mileage. Only the address text needed for that calculation is sent.
• Google (Routes API): if you turn on leave-time reminders, calculating a live traffic-aware driving time. Only your home and practice coordinates needed for the route are sent, and only while that reminder is enabled.
• Apple Push Notification service (APNs): if you enable notifications in the app, delivering them to your device. We register a device token with Apple, and the notification content (for example a shift or invoice reminder) is transmitted through Apple to reach your device. Notifications are off until you turn them on, and you can disable them at any time.

When you share an invoice or an export from the app, you choose the recipient and the method (for example email or your device’s share sheet). That sharing is initiated by you.

Data retention

We keep your information for as long as your account is active. You can delete individual shifts, practices, invoices and expenses at any time. When you delete your account, all of your data, including your profile, settings, shifts, practices, invoices, expenses and any receipts you attached, is permanently removed from our database and file storage.

Deleting your account

You can permanently delete your account and all associated data directly in the app: go to Settings → Delete account, confirm with your password, and your account and data will be erased. This action cannot be undone.

Security

Data is transmitted over encrypted connections (HTTPS) and stored on secured, access-controlled infrastructure. Passwords are stored only as salted hashes. While no system can be guaranteed perfectly secure, we take reasonable measures to protect your information.

Your rights

Depending on where you live (including under UK/EU GDPR), you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. You can exercise most of these directly in the app, or contact us using the details below.

Children

Locumo is intended for working professionals and is not directed to children. We do not knowingly collect personal information from children.

Changes to this policy

We may update this policy from time to time. When we do, we will revise the “Last updated” date at the top of this page.

Contact us

If you have any questions about this policy or your data, contact us at kumell@teleop.co.uk.