Locum Pharmacist privacy policy

The app, and the website at locumpharmacistapp.co.uk

Last updated 31 October 2026

The short version. Locum Pharmacist keeps your shifts, invoices, expenses, mileage and tax figures for you. You can use the app with no account at all, and then everything stays on your phone. If you sign in, your records are also kept on our server so the website and your phone stay in step.

Your bank details, National Insurance number and GPhC registration number are locked on your own devices before they go anywhere. We hold only scrambled text, and we can’t read it. Nothing is measured, there are no ads, and we don’t sell or share your information.

Who we are

Locum Pharmacist is made and run by Michael Howes, and he is the data controller for what is described here. You can reach us at hello@locumpharmacistapp.co.uk, or with Contact us inside the app.

Two ways to use it

On its own, with no account

You never have to sign in. Your name and address, bank details, National Insurance number, GPhC number, the pharmacies you work at, every shift, rate, distance and expense are stored in the app’s own storage on your phone. None of it is sent to us. If you lose the phone or delete the app, it’s gone unless you made a backup to a file.

Signed in, with sync

If you sign in, the app also keeps your records on our server. That’s what lets you use the website, keeps a second copy safe if your phone is lost, and lets a change on one show up on the other. Signing in is optional and you can stop at any time.

What we hold when you have an account

Your email address. It’s how you sign in. We email you a six-digit code; there is no password.
Your records. Shifts, their hours and rates, pharmacies and their addresses and email addresses, invoices and credit notes (with their numbers, lines and dates), other work, expenses, mileage, your name, address and phone number, your tax settings, shift shortcuts and your email template.
Your plan. When your free trial started, and what you have bought (see Payments below).
Where you are signed in. For each phone and browser signed in to your account: when it signed in, when it was last used, and the name it gives itself (such as “Chrome on Windows”). It is how sign-in works, and you can see the list and sign any of them out from your phone or the website.
Emails we send for you, if you turn it on. Whether it is on, the address copies and replies go to, and, for each email sent, who it went to, its subject, which invoice it carried and when. Never the message or the document itself (see Sending emails for you).
Invoice numbers. We keep the numbers each of your devices has been given, so two devices never issue the same one.
A device ID. A random code your phone or browser makes for itself, sent with each request, used only to keep those invoice numbers straight.

What is locked, and what isn’t

These are locked (encrypted) on your device before they are sent, and we can’t read them:

your bank account name, account number and sort code, including the copy inside each invoice
your National Insurance number
your GPhC registration number

The key stays on your devices, kept in your phone’s secure storage, and never comes to us. When you first sign in the app gives you a recovery code to keep somewhere safe. If you lose every device and the code, we can’t get these details back for you, and you would type them in again. The rest of your records are not locked in this way, because the service has to work with them, and they are what you need to keep for your tax records. They are encrypted in transit and at rest by our hosting provider, and each account can only read its own.

There is one exception, and only if you choose it. If you use “Send for me”, the invoices you send are made readable on your device and pass through our server and our email provider, Resend, to reach the pharmacy. That includes the bank details printed on them. We don’t store the invoices. Resend keeps each email for 30 days. Sending from your own email app instead keeps them off our server.

The website shows the locked details only once you pair it with your phone, by scanning a code shown on the site. The key is passed from your phone to your browser in a form only that browser can open; it doesn’t pass through us in a readable state.

Who else handles it

We use a small number of services to run this. Each is told only what it needs, and none uses it for its own purposes.

Service	What it does	What it receives
Supabase (London)	Holds your account and records, and signs you in.	Your email address and the records described above, with the locked details as scrambled text.
Resend	Sends the sign-in code, the emails you send us through Contact us, and the invoices you ask us to send to a pharmacy.	Your email address, the message, and the name you gave. For an email we send for you, the pharmacy’s email addresses, your copy address, your name, the message from your template, and the invoice, including the bank details printed on it. Resend keeps each email for 30 days.
Cloudflare	Hosts this website and delivers it to you, and forwards email sent to hello@locumpharmacistapp.co.uk to us.	Your IP address and the page you asked for, as for any website, and any email you send us. It doesn’t see your records.
RevenueCat	Looks after subscriptions, so a plan bought on your phone works on the website too.	Your account’s random ID (or an anonymous one if you haven’t signed in), what you bought and when, and the store it came from. Never your name or your email.
Apple and Google	Take payment when you subscribe in the app.	Their own dealings with you, under their own policies. We are told what you bought, not your card.

Where your information goes

UK law lets personal data go to another country only under a recognised safeguard. Here is where each service handles it, and the safeguard it relies on.

Service	Where	The safeguard
Supabase	Your records are stored in London. Supabase is a US company, so its staff and suppliers elsewhere may be able to reach them.	The standard contractual clauses in its data processing agreement, with the UK’s addendum to them. The agreement applies automatically when we accept its terms.
Resend	Emails are sent from Ireland. Resend is a US company, so its staff and suppliers elsewhere may be able to reach them.	Certified under the UK extension to the EU–US Data Privacy Framework (the “UK–US data bridge”), and its agreement also includes the standard contractual clauses with the UK addendum.
Cloudflare	Its network of data centres around the world.	The standard contractual clauses with the UK addendum, and the Data Privacy Framework where it applies.
RevenueCat	The United States (its hosting is with Amazon Web Services and Snowflake).	The standard contractual clauses with the UK’s international data transfer addendum, both part of its data processing agreement.
Apple and Google	As set out in their own policies.	Their own, for what they handle. They are separate from us.
HeiGIT (road distances)	Germany.	None needed. The UK treats transfers to the European Economic Area as adequate.
NHS Organisation Data Service and postcodes.io (lookups)	The United Kingdom.	None needed, as the data stays in the UK.

You can ask us for a copy of the contractual terms we rely on for any of these, at hello@locumpharmacistapp.co.uk.

Payments and your plan

Everything is free for your first 90 days. After that, your shifts, invoices, expenses, mileage and statements stay free, and Locum Pharmacist Pro is a paid subscription. In the app the store (Apple or Google) takes the payment. Either way, your plan is recorded against your account so it works on both. We never see or keep your card number.

Looking things up

A few features ask an outside service a question. Each request is an ordinary web request, so the service sees your IP address. None is sent your name, your shifts, your rates or your documents, or any ID for you.

Finding a pharmacy. The name or postcode you type goes to the NHS Organisation Data Service, so the pharmacy’s address and ODS code can be filled in.
Working out mileage. Your home postcode and your pharmacies’ postcodes are sent to postcodes.io, which returns their coordinates. With Locum Pharmacist Pro, the coordinates of home and each pharmacy are then sent to the OpenRouteService routing service run by HeiGIT, in the EU, which returns driving distances. Postcodes and coordinates are the only things sent. A postcode is still personal data, which is why it is written down here.

Documents, calendar and messages

Documents. Invoices, credit notes, statements and Making Tax Digital workbooks are made as files on your phone or in your browser. They go somewhere else only when you send them, through your phone’s share sheet or your own email. We aren’t told where they went.
Calendar. The app can add your shifts to your phone’s calendar, if you switch it on and allow it. It doesn’t read your other appointments, and nothing about your calendar leaves the phone.
Calendar link (website, optional). If you switch it on, the website makes a private web address for your account, and your calendar (Google, Apple or Outlook, whichever you choose) fetches your shifts from it and keeps a copy. Each entry has the pharmacy, its address, the shift description and the times, and never your rate, fees or invoices. Anyone who has the address can see that, so treat it like a password. You can replace it, which stops the old one working, or turn it off, on the same page. Your calendar provider looks after its copy under its own policy. Deleting your account ends the link. Nothing about it is sent anywhere unless you switch it on.
The camera. The app uses the camera only to scan the pairing code when you add another phone or pair the website, and only when you choose to. No picture is kept or sent.
Contact us. The name, email address and message you send, and the app version so a bug can be placed, reach us by email. We use them only to answer you, keep them for up to 12 months after the conversation ends, and never add you to a mailing list.

Sending emails for you

If you are signed in, the app and website can email an invoice to the pharmacy for you, instead of you sending it from your own email. It is off until you turn it on, and you are asked the first time.

Your phone or browser makes the invoice, as it always does, and sends it to our server, which hands it straight to Resend to deliver. It passes through us readable, including the bank details printed on it, and we don’t store it. Resend keeps each email, with its attachment, for 30 days.
The email comes from our address, under your name (“Jane Smith via Locum Pharmacist”). Replies go to you, and a copy is sent to you. That address is the one you sign in with, or another you confirm with a code we email to it, so nobody can have copies sent to an address that isn’t theirs.
For each email we keep who it went to, its subject, which invoice it carried, when, and Resend’s reference for it: so you can be sure it went, to limit how many go in a day, and to answer a pharmacy that says nothing arrived. We delete these records after 13 months, and with your account.
You can turn it off at any time, under Account on the website or Backup and sync in the app. Sending from your own email app keeps the invoice off our server altogether.

Signing in on a computer with your phone

On locumpharmacistapp.co.uk you can sign in by scanning a code with the app on your phone, instead of an emailed code.

While the code is on screen (three minutes at most), we hold the computer’s one-time public key, the name its browser gives (such as “Chrome on Windows”) so your phone can show you what is asking, and whether you said it is a shared computer. Your phone shows you this before you approve.
When you approve, your phone locks your key to that computer so only it can open it, as pairing does: it passes through us unreadable. We make a one-time sign-in for your account, handed only to the computer that asked, and then delete the request.
On a shared computer, the sign-in and your key are kept only for that browser tab, so closing it signs you out, and the website signs out by itself after 30 minutes unused. Nothing is left on the computer.
Only approve a code on a computer in front of you, at locumpharmacistapp.co.uk. You can see every phone and computer signed in, and sign any of them out, from your phone or the website.

No analytics, tracking or ads in the app or on the website

The app contains no analytics, advertising, tracking or crash-reporting service. It doesn’t read your advertising ID, and it doesn’t measure how you use it. The one thing we look at is when an account was last used, so that accounts nobody uses can be deleted (see How long we keep it).

The website has no analytics, advertising or tracking either, and uses no cookies.

Separately, and only to keep you signed in, the website stores your sign-in in your browser’s own storage, and, if you have paired it, the key to your locked details. That isn’t a cookie and isn’t shared with Cloudflare or anyone else. Signing out removes both.

How long we keep it

Your account and records stay until you delete the account, or until it has gone unused for two years. If it has, we email you about a month before, saying the day it will be deleted; opening the app so it syncs, or signing in on the website, before then keeps it. An account with a subscription that has not ended is not deleted this way. Deleting removes everything from our server straight away. Copies in the database’s own rolling backups can survive for up to 7 days more, and then go. A subscription record kept by RevenueCat, and what the stores must keep about a payment, are held by them under their own rules and financial record-keeping duties. Messages you send us are kept for up to 12 months. How to delete your account is on the deleting your account page.

Why we’re allowed to use it

Under UK GDPR, we use your records because you asked us to provide the service (a contract). We use messages you send us because it’s in our legitimate interest to answer someone who has written in. We don’t use your information for anything else.

We don’t make decisions about you by automated means, and we don’t profile you. The tax figures the app shows are worked out from what you enter, for you to use. Nothing is decided about you from them.

Your rights

You can ask to see, correct, delete or take a copy of what we hold about you, and to object to how it is used. Most of it you can do yourself: the website’s Account page has Download my records, which gives you a copy of everything on the server, and the account can be deleted there or in the app. For anything else, write to hello@locumpharmacistapp.co.uk and we’ll reply within a month. If you’re unhappy with how a request is handled, you can complain to the Information Commissioner’s Office.

Children

Locum Pharmacist is a professional tool for pharmacists. It isn’t aimed at anyone under 18.

Changes to this policy

If the app or the website starts to do something with your information that this page doesn’t describe, we’ll update this page before that version is released, and the date at the top will change.

Questions

Email hello@locumpharmacistapp.co.uk, or use Contact us inside the app.