Privacy Notice | FindALocum

Who handles your information

FindALocum is responsible for the personal information handled through this website and recruitment enquiry service. Use the contact form for privacy questions or requests about your information. The parties and terms for any proposed booking are set out in its agreement before you enter it.

You can also write to FindALocum at Queen Street Chambers, 68 Queen Street, Sheffield, South Yorkshire, S1 1WR.

What we collect

All enquiry forms collect your name, email, optional phone number and the details you provide about your request. Professional registration enquiries ask for your profession, preferred country and area, with optional availability, work setting, work mode and self-reported professional registration number. Work mode records an on-site, remote or hybrid preference. Cover requests ask for the organisation, profession, country, location and dates, with optional work setting and work mode.

We store the enquiry reference, submission time, processing status, relevant page or region, any selected vacancy and the version of the privacy notice acknowledged. Required fields provide the minimum details needed to receive and handle that type of enquiry; without them, the form cannot be submitted. Optional fields are marked. Do not send patient information, identity documents, health information or bank details through these forms.

Why we use it

For general enquiries, initial discussions about work and cover requests made on behalf of an organisation, we rely on our legitimate interests in responding to requests and providing a recruitment enquiry service. We use the contact and work details needed to understand the request and discuss suitable next steps.

Where you personally ask us to take steps towards an agreement with you, we rely on the contract basis only for processing necessary to take those steps. A practice’s agreement does not, by itself, make an employee contacting us on its behalf a party to that contract.

We rely on legitimate interests to protect the website from misuse and maintain service security. We use information to handle data-protection complaints, information-rights requests and required recruitment records on the basis of the legal obligations that apply. Optional analytics relies on consent, as explained below.

GP, pharmacist, pharmacy technician and practice nurse enquiries relate to our active recruitment services. Pharmacy enquiries can also concern community pharmacy or hospital work. Submitting a form does not add you to an unrelated marketing list. The privacy acknowledgement records that the notice has been presented; it is not marketing consent.

Accounts

If you create a FindALocum account, we keep your name, email address, the sign-in details and security settings you choose, and a record of what you agree to, such as our terms. You sign in with a 6-digit code we email you; staff accounts also use a password and two-step sign-in. We use your account to run the service you asked for, on the basis of our contract with you or the steps you ask us to take towards one.

Locum profiles, checks and documents

Locums give us their profession, registration number, indemnity details, postcode, travel distance, working preferences and any documents they upload. Our staff check the registration on the official register, the indemnity and the documents before a locum can be booked. We do this to meet our legal duties and our legitimate interest in introducing only suitable clinicians.

Guided onboarding also records your employment and training history, explanations of gaps, relevant experience and professional referees. When you submit with permission to contact them, we send referees a private form and limited reminders. Referees see your name and the organisation you nominated them for, not your documents or other references. We retain their factual response and our review as recruitment evidence, restrict access to the reviewing team and use the information to assess suitability. You can withdraw unanswered reference requests. Contact us to discuss a received reference or exercise your information rights.

CV and training-certificate reading happens on your device and only suggests details for you to check. Your saved history and documents are sent to FindALocum when you save or upload them. Staff record onboarding conversations and assignment-specific clearance decisions. Occupational health assessments are handled by the appropriate provider; record only the clearance outcome and necessary adjustments in FindALocum, not medical records. Guided onboarding and reference-form pages do not load analytics. Automated checks, reminders and booking holds support the reviewing team; they do not make the final clinician approval or rejection decision.

We use the certificate dates you provide to flag missing, ageing or expiring evidence. Our optional document reader runs on your device and suggests dates and policy details from PDF text or scans. It does not send the document to an external OCR or AI provider or retain the extracted text. You check and choose whether to use its suggestions; staff can also read a submitted certificate on their device. These reminders and suggestions do not authenticate a document. Staff review the evidence and make the final approval or rejection decision; an automated result alone does not approve or reject you.

If you confirm that your DBS certificate is on the Update Service and give permission, authorised staff can request its current status from DBS after confirming the required identity, original-certificate and role checks. The request sends DBS your certificate number, surname and date of birth, together with our organisation and the checking staff member’s name. We retain the status result, check time, checking staff member and consent record; we do not retain the certificate number or date of birth from that request. Any certificate you separately upload remains a document on your account. You can withdraw permission for future Update Service checks in your locum checks page. A result requiring a new certificate is referred to staff, not treated as an automatic rejection.

A practice sees a checked locum’s name, profession, registration and distance when the locum applies or is offered a shift, and their email address and phone number once a booking is confirmed. Practices do not see your documents.

Right to work checks

The law requires us to check every locum’s right to work in the UK before they can be booked. If you have a British or Irish passport, TrustID, a government-certified identity service, checks it online using a photo of your passport and of you, and sends us a report. Otherwise you give us a Home Office share code and your date of birth, which we use to view your status on GOV.UK; we delete the share code and date of birth once we have decided.

We keep the check result for as long as you work through FindALocum and for 2 years after your last booking, as the Home Office requires, and then delete it. Our legal basis is the legal obligation to carry out these checks.

Availability and matching

If you post the days and times you can work, a checked practice whose request fits your times, profession and travel distance can see your first name and initial, your profession and how far away you are, and can offer you the shift. We use your postcode area and travel distance to work out the distance; we do not show your postcode to practices. You can change or remove your availability at any time.

Practices

For practices we keep the practice name and address, its NHS ODS code, the people who manage it, the shifts posted, bookings and invoices. We check a new practice against NHS England’s public list of organisations; a practice found there, at the same postcode, whose user registered with an NHS email address can be approved without a manual review.

Job applications

If you apply for a job at FindALocum through our careers pages, we use your name, email address, any phone number you give us, your message and the role you applied for to consider your application, contact you and arrange interviews. We rely on the steps you ask us to take before entering an employment contract, and on our legitimate interest in recruiting suitable staff. Please leave health information and identity documents out of your application; we ask for anything else we need later in the process.

Only the people involved in hiring for the role see your application. If we offer you a job, we check your right to work in the UK before you start, as the law requires, and we give you separate information about how we handle staff records.

If your application is unsuccessful, we delete it 6 months after the role closes, unless you agree that we can keep it for future vacancies. You can withdraw your application at any time through the contact form.

Account emails, texts and payments

We send account emails, such as sign-in codes, check results, shift alerts, booking notices and invoices, from accounts@findalocum.co.uk. If you add and confirm a mobile number and turn on text alerts, we send texts through our text message provider; you can reply STOP or turn them off in your profile. If you pay an invoice by card, Stripe processes the payment and we do not see your card details.

Automated assistance

Our phone line, 0113 519 5545, is answered by an automated AI assistant. Our website chat also uses an automated assistant when it is available. The assistant identifies itself and uses information approved by our team, but its answers can contain mistakes. It cannot confirm bookings, accept or reject a locum, or agree terms. It does not make decisions about you with legal or similarly significant effects.

You can use our contact form to ask for a person or to contact us without using the recorded phone line. Asking the phone assistant for a person does not connect you to a live operator. Do not give the assistant patient information, medical details, identity documents, payment card details or other sensitive information. This is a recruitment enquiry service, not a clinical or emergency service.

Recorded phone calls

Calls to 0113 519 5545 are recorded. The assistant tells you this at the start. We process your voice, the number you call from unless it is withheld, the date, time and duration of the call, a transcript and a summary. We also process details you choose to provide, such as your name, organisation, email address, callback number and the reason for calling.

We use call information to understand and respond to recruitment enquiries, follow up requested messages or callbacks, review the accuracy and quality of the assistant, and prevent misuse. Our lawful basis is our legitimate interests in responding to callers and operating a reliable recruitment enquiry service. Where you personally ask us to take necessary steps towards an agreement, the contract basis described above may also apply.

You can object to processing based on legitimate interests, or request access to or deletion of your call information, using the contact form. Include the approximate call date and the number you called from if available, so we can locate the record. These rights are subject to the conditions explained under Your rights. If you do not want your call recorded, use the contact form instead.

Website chat and visit information

When website chat is available, we keep messages and files you send, details you choose to give us, the pages where the chat is used, timestamps and your device's IP address. If you press Save my details, the details displayed on the confirmation card are submitted as an enquiry. The privacy acknowledgement and enquiry rules above also apply.

While the chat service is active on the website, it records page visits, timestamps, IP addresses, the country associated with an address, and a publicly available network or organisation name where one can be identified. We use these records to recognise returning visits, decide whether to offer help and prevent misuse. A network name does not necessarily identify the individual visitor.

We rely on our legitimate interests in answering questions and operating the recruitment enquiry service for chat handling, service quality and security. Optional Google Analytics is separate and follows the consent choices explained below.

Chat and phone service providers

Cloudflare hosts the chat service and its records. Authorised team members can review messages, call transcripts and summaries to handle enquiries, investigate problems and improve service information.

Text sent to the website assistant is processed through OpenRouter by Anthropic. Our requests select zero-data-retention endpoints and prohibit provider data collection for model training. This setting concerns prompt and response content; providers may still process usage, billing and security metadata. Brief in-memory prompt caching can occur. Uploaded files are kept in our chat storage and are not sent as files to the model.

Twilio provides the phone number and routes calls. Call recording is handled by ElevenLabs, which provides the voice assistant, transcription and summaries using an Anthropic model. The phone service is not configured for zero retention. Our Twilio and ElevenLabs accounts are provided through Virtual Pharmacist Ltd; FindALocum remains the contact for requests about these service records.

These services may process information outside the UK, including in the United States. ElevenLabs' data processing addendum incorporates standard contractual clauses with the UK Addendum for relevant transfers. Twilio's terms describe the UK Extension to the EU-US Data Privacy Framework and contractual transfer safeguards where applicable. Provider privacy notices and data processing terms are linked below. You can use our contact form to request information about the safeguards relevant to your data.

Chat and call retention

The phone assistant is configured for a 30-day retention period for recordings and transcripts at ElevenLabs. This is separate from written call records held in our team inbox. Provider backup, security and legal retention exceptions are described in its terms.

Our team inbox is configured to delete chats, related files and imported call transcripts and summaries 90 days after the last message. Records marked as an enquiry ready for follow-up, or flagged for emergency-related content, are kept for up to two years after the last message. Deletion runs through scheduled cleanup. A requested callback alone does not automatically create a two-year retention period.

Website visit records and blocks applied to an IP address for misuse are kept for 30 days. Files uploaded but not sent are scheduled for removal after one hour. Saved enquiries follow the separate enquiry retention rules below.

Chat browser storage

The chat uses browser local storage for a random conversation reference and whether you have rated the conversation. The conversation reference can remain valid for up to 30 days. The widget normally forgets it after an hour without activity. Ending the visible chat does not immediately erase the reference or the conversation records held by our team.

You can remove this browser storage by clearing this website's site data. To request deletion of records held by us, use the contact form. Removing browser storage does not itself delete those records.

Security and abuse prevention

Forms use encrypted connections, server-side validation, submission limits and duplicate protection. Abuse-prevention records use temporary hashes derived from the connecting IP address and a changing date value. Raw IP addresses are not stored in the enquiry database. These records are separate from enquiries and are normally cleared within 48 hours plus the hourly cleanup interval.

Hosting providers may process network and security information to run and protect the service. Access to stored enquiries requires authenticated administrative access. There is no public candidate directory.

How long we keep information

Our retention policy requires a manual review six months after receipt of an initial enquiry for which no work-finding action has been taken. Information should then be deleted or anonymised unless there is a continuing, documented need. There is no automatic deletion at six months.

Records of actual work-finding services are different, even when no booking results. Where Great Britain’s Conduct Regulations apply, the relevant records must be kept for at least 12 months after creation and at least 12 months after the last work-finding service. Other applicable legal requirements, including those for Northern Ireland, must be considered before deletion.

Account records are kept while your account is open. Right-to-work check results are kept for 2 years after your last booking, as described above. Booking, payment and complaint records are retained for the period needed for their purpose and applicable legal obligations. An unresolved dispute may also justify retaining relevant information. Further collection for a booking or compliance checks needs the appropriate privacy and retention information at that stage. You can ask us to remove a withdrawn enquiry; if a record must be kept lawfully, we will explain why.

Your rights

Depending on the circumstances, you can request access, correction, erasure, restriction or portability of your personal information. Use the contact form to explain your request. We may need proportionate information to confirm your identity.

You can object to processing based on legitimate interests. We consider the circumstances you raise and whether there is a lawful reason to continue. Where processing relies on consent, you can withdraw it; this does not affect processing carried out lawfully before withdrawal.

We respond to information-rights requests without undue delay, normally within one calendar month. If an extension is permitted or we need information to deal with your request, we explain what is needed and how this affects the response time. These rights are subject to the conditions and exceptions in data-protection law.

Data protection complaints

Use the contact form linked below to complain about how we handle your personal information. Explain what happened and, if available, include your enquiry reference and the outcome you are seeking. No particular wording is required. Do not include patient information or sensitive documents in the form.

We acknowledge data-protection complaints within 30 days of receipt and investigate without undue delay, starting when the complaint is received. We keep you informed of progress and explain the outcome and any action taken. This acknowledgement period is separate from the response time for an information-rights request.

You can also complain to the Information Commissioner’s Office using the link below. You do not have to give up that right while we consider your concern.

Optional website analytics

With your consent, we use Google Analytics 4 to understand use of our pages and count completed enquiries. We load Google's analytics service only after you accept analytics cookies. Rejecting analytics does not affect the website or enquiry forms.

When enabled and accepted, analytics receives a page address without query parameters or fragments, the referring website's origin without its path or query, and basic device and browser information. Google processes the network connection, including your IP address, to deliver its service. Google states that GA4 does not log or store individual IP addresses. First-party analytics cookies distinguish browser visits. Vacancy pages use a generic analytics address and title.

A completed enquiry is counted only after the form receives a saved-enquiry confirmation. The analytics event contains only its broad type: candidate, employer or contact. We do not send names, email addresses, telephone numbers, messages, professional registration numbers, work preferences, receipt references or vacancy identifiers to Google Analytics. Enquiry details remain separate from analytics.

Our basis for optional analytics is consent. Advertising storage, advertising user data and advertising personalisation consent remain denied. Google signals and advertising personalisation are disabled. You can change or withdraw your choice through Cookie settings in the footer. Withdrawal stops further analytics collection and removes this site's Google Analytics cookies; it does not undo information already sent with consent.

Our Google Analytics property uses a two-month retention period for event and user data, with retention reset on new activity disabled. Aggregate reports may remain available for longer. The browser consent choice and analytics cookies have a maximum duration of 180 days. Google may process information internationally; its data processing terms explain the applicable transfer safeguards.

Website recordings and analytics with PostHog

If you accept analytics, we also use PostHog to see how people use the website and the locum and practice portals, so we can fix pages that confuse people or get in their way. PostHog records the pages you visit, the buttons and links you select, scrolling and mouse movement, and makes a replay of the visit. Nothing loads, and nothing is sent, until you accept.

Anything you type into a form is hidden in your browser before it is sent, including names, email addresses, passwords, codes and registration numbers. Inside the signed-in portals, all words on the screen and all images are hidden in replays too, so the details of other people, practices and shifts are not captured. Pages that show security codes, password reset or invitation links, support links or identity and right-to-work documents do not load analytics at all. Admin pages are never recorded.

If you have a FindALocum account and accepted analytics, we link this activity to your account: your name, email address, whether you use FindALocum as a locum or a practice, your profession and your practice's name. Earlier visits from the same browser are linked too. We use this to help you when something goes wrong and to understand how people use the service. Page addresses are sent without query details or fragments, and the referring website is reduced to its origin. PostHog uses your IP address to estimate your town and country.

PostHog runs the service for us as our processor from its EU cloud in Frankfurt, Germany. PostHog Inc. is based in the United States; its data processing agreement sets out the safeguards for any access from outside the UK and EU. We keep replays for up to 30 days and other PostHog analytics for up to one year. Our basis is consent. You can change or withdraw your choice at any time through Cookie settings in the footer: PostHog stops straight away and its cookies and browser storage are removed. Signing out also stops linking that browser to your account.

Cookies and updates

The cookie notice explains how this website uses browser storage. Any updates to this privacy notice will be published here with a revised date.

Useful links

Contact FindALocum →

Privacy notice.