Privacy Policy

Last updated: 1 March 2025

1. Introduction

LocumShift AI Ltd (company number 17235623) (“we”, “us”, “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use our platform, website, and services (collectively, the “Services”).

We are registered with the Information Commissioner's Office (ICO) under registration number ZA123456. Our registered address is 128 City Road, London, EC1V 2NX, United Kingdom.

2. Data We Collect

2.1 Personal Data

We may collect the following categories of personal data:

  • Identity Data: Full name, date of birth, gender, photo ID
  • Contact Data: Email address, telephone number, postal address
  • Professional Data: NMC PIN, GMC number, DBS certificate details, qualifications, employment history
  • Financial Data: National Insurance number, bank account details (for payroll processing)
  • Technical Data: IP address, browser type, device information, login data
  • Usage Data: How you use our Services, features accessed, pages visited
  • Communication Data: Messages sent and received through our messaging channels

2.2 Special Category Data

In the context of healthcare staffing, we may process special category data including health information (e.g., Hepatitis B vaccination status) and criminal records data (DBS checks). We process this data only with your explicit consent and as necessary for compliance with employment law obligations.

3. How We Use Your Data

We use your personal data for the following purposes:

  • Providing and managing the LocumShift AI platform
  • Matching candidates with available shifts based on skills, availability, and compliance status
  • Processing compliance documents using AI-powered OCR verification
  • Sending shift notifications, compliance reminders, and timesheet requests via your preferred messaging channel
  • Processing timesheets and facilitating payroll
  • Communicating with you about your account and our services
  • Improving our Services through anonymised analytics
  • Complying with legal and regulatory obligations

We process your personal data under the following legal bases as defined in UK GDPR:

  • Contract: Processing necessary for the performance of our contract with you or your agency
  • Legal Obligation: Processing necessary for compliance with healthcare regulations, employment law, and tax obligations
  • Legitimate Interest: Processing necessary for our legitimate business interests, such as improving our Services and preventing fraud
  • Consent: Where you have given explicit consent, particularly for special category data and marketing communications

5. Data Sharing

We may share your personal data with:

  • Healthcare Staffing Agencies: Your employing agency to facilitate shift management and compliance
  • Healthcare Facilities: Limited data necessary for shift fulfilment (name, qualifications, compliance status)
  • Payroll Providers: Parasol, Giant Group, or other umbrella companies as directed by your agency
  • Cloud Service Providers: AWS for hosting and data storage, with all data stored within the UK/EEA
  • AI Service Providers: Anthropic (Claude API) for document OCR processing — only document images are shared, not personal identifiers
  • Regulatory Bodies: When required by law, such as CQC, HMRC, or law enforcement

6. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

  • AES-256-GCM encryption for all personally identifiable information at rest
  • TLS 1.3 encryption for all data in transit
  • Multi-tenant data isolation ensuring your agency's data is completely separated from other organisations
  • Keycloak-based authentication with multi-factor authentication support
  • Role-based access controls limiting data access to authorised personnel only
  • Regular security audits and penetration testing
  • Encrypted backups with geo-redundant storage

7. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes for which it was collected, and in accordance with UK employment law requirements:

  • Active account data: For the duration of your relationship with your agency
  • Compliance documents: 7 years from the date of last activity, as required by employment law
  • Timesheet data: 7 years for tax and payroll compliance
  • Communication logs: 2 years from the date of communication
  • Technical logs: 12 months

8. Your Rights

Under UK GDPR, you have the following rights:

  • Right of Access: Request a copy of the personal data we hold about you
  • Right to Rectification: Request correction of inaccurate personal data
  • Right to Erasure: Request deletion of your personal data (subject to legal retention requirements)
  • Right to Restrict Processing: Request limitation of how we process your data
  • Right to Data Portability: Receive your data in a structured, machine-readable format
  • Right to Object: Object to processing based on legitimate interests
  • Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent

To exercise any of these rights, please contact our Data Protection Officer at [email protected].

9. Cookies

Our website uses cookies and similar technologies. For detailed information about the cookies we use and how to manage your preferences, please see our Cookie Policy.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on our website and, where appropriate, by email. The date of the last update is shown at the top of this page.

11. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

  • Data Protection Officer: [email protected]
  • General Enquiries: [email protected]
  • Post: LocumShift AI Ltd, 128 City Road, London, EC1V 2NX, United Kingdom
  • ICO: You have the right to lodge a complaint with the Information Commissioner's Office at ico.org.uk