Privacy Policy

Last updated: 4 August 2026

Reverse Locum is committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and all applicable UK data protection legislation. This policy explains what data we collect, why we collect it, how we use it, and your rights.

1. Data Controller

Reverse Locum is the data controller for personal data processed through this platform. If you have any questions about this policy or your personal data, contact us at:

admin@reverselocum.com

2. What Data We Collect

We collect the following categories of personal data:

Account & Identity Data

Full name, email address, phone number
Password (stored encrypted)
User type (pharmacist or pharmacy)

Professional Data (Pharmacists)

GPhC registration number
Professional qualifications and services
Hourly rate and availability
Professional biography

Compliance & Verification Documents (Pharmacists)

Photo ID (passport or driving licence) — processed for identity verification
DBS check certificate
Right to Work documentation
Indemnity insurance certificate
Service accreditation evidence

Pharmacy Data

Pharmacy name, GPhC registration
Address and contact details

Usage & Booking Data

Booking history and communications
Reviews and ratings
Platform activity logs

3. Legal Basis for Processing

Contract performance (Art. 6(1)(b)): Processing your account, profile, bookings, and payments.

Legal obligation (Art. 6(1)(c)): Right to Work verification, DBS checks, and regulatory compliance.

Legitimate interests (Art. 6(1)(f)): Platform security, fraud prevention, and improving our services.

Explicit consent (Art. 9(2)(a)): Processing special category data such as identity documents submitted for verification. You may withdraw consent at any time by contacting us.

4. How We Use Your Data

To create and manage your account
To facilitate bookings between pharmacists and pharmacies
To verify your identity and professional credentials
To process payments and issue invoices
To send important service communications
To ensure compliance with healthcare regulations
To investigate disputes and enforce our Terms of Service

5. Automated ID Verification

When pharmacists submit identity documents, we use AI-powered analysis to perform an initial automated check for document validity, legibility, and authenticity. This check is used solely to assist our compliance team and does not constitute a solely automated decision affecting you. A human reviewer makes the final compliance decision. The document image is used only for this purpose and is stored securely. You have the right to request human review of any automated assessment.

6. Data Sharing & Third-Party Processors

We share your data only with the following categories of recipients:

Pharmacies you are booked with or apply to work for (professional profile only)
Stripe — our payment service provider. When you make or receive a payment, Stripe processes your card details and transaction data. Stripe acts as an independent data controller for the payment data it processes. You can read Stripe's privacy policy at stripe.com/privacy.
Our technology infrastructure provider (Base44), under a written data processing agreement incorporating Standard Contractual Clauses
Regulatory or law enforcement bodies when legally required

We do not sell your personal data to third parties.

7. International Data Transfers

Our application is built and hosted using Base44. Base44 processes personal data on our behalf as a data processor, and our application data is currently stored in the United States.

Our payment processor, Stripe, and certain other service providers may also process personal data in the United States or other countries outside the United Kingdom.

Where personal data is transferred outside the United Kingdom, we ensure that the transfer is made in accordance with UK data-protection law. We rely on the transfer mechanism set out in the relevant service provider's Data Processing Agreement. Depending on the provider and the circumstances, this may include:

UK adequacy regulations, including the UK Extension to the EU–US Data Privacy Framework where the recipient is appropriately certified;
the UK Addendum to the European Commission's Standard Contractual Clauses;
the UK International Data Transfer Agreement; or
another legally recognised transfer safeguard.

Where required, we undertake a transfer risk assessment and apply appropriate contractual, technical and organisational safeguards to ensure that the protection of personal data is not materially lower following the transfer.

Identity-verification information may include copies of identity documents and, where facial-matching technology is used, biometric data. DBS documentation may contain criminal-offence data. Access to this information is restricted, and it is retained only for as long as reasonably necessary for verification, safeguarding and legal compliance purposes.

Further information about the service providers and safeguards used for international transfers is available on request.

8. Data Retention

We retain your data for as long as your account is active. Compliance documents are retained for 6 years after your last booking to comply with healthcare employment law. You may request deletion of your account and data at any time (subject to legal retention requirements).

9. Your Rights

Under UK GDPR you have the right to:

Access

Request a copy of your personal data

Rectification

Correct inaccurate personal data

Erasure

Request deletion of your data ('right to be forgotten')

Restriction

Restrict how we process your data

Portability

Receive your data in a machine-readable format

Object

Object to processing based on legitimate interests

Withdraw Consent

Withdraw consent for special category data at any time

Complain

Lodge a complaint with the ICO (ico.org.uk)

To exercise any of these rights, email us at admin@reverselocum.com. We will respond within 30 days.

10. Cookies

We use only strictly necessary cookies for session management and authentication. We do not use tracking or advertising cookies.

11. Changes to This Policy

We may update this policy periodically. Significant changes will be communicated to you by email. Continued use of the platform after changes constitutes acceptance.

Questions? Contact our Data Protection Lead at admin@reverselocum.com