Privacy policy

Locum (the website at locum.now and the Locum mobile app) is operated by ARISDY LIMITED, a New Zealand company (company number 9395605, NZBN 9429053354464) with its registered office at 24F Mount Smart Road, Royal Oak, Auckland, New Zealand (“ARISDY”, “we”, “us”).

This policy explains what personal information we collect, why, who we share it with, and the choices you have. We handle personal information in accordance with the New Zealand Privacy Act 2020 and, for users in Australia, the Australian Privacy Act 1988 and the Australian Privacy Principles.

Account and sign-in. Locum uses Google and Apple sign-in only. When you sign in we receive your name, email address, and a provider identifier. We never see or store a password for you.

Profile and professional details. The sectors, roles, and countries you work in, and the profile details you choose to add. For employer users: your organisation, its locations, shift-day briefings, and contact directory entries.

Documents. Files you upload to your document library (for example certificates or practising documents). They are stored in private storage and shared only when and with whom you direct.

Activity on the platform. Job posts, applications, offers and their outcomes, chat messages between the parties to an application, calendar entries including external shifts you log yourself, and invoices you create — including the recipient, line items, amounts, GST treatment, and any payment details (such as a bank account number) you choose to place on an invoice.

Billing (employers). Employer subscriptions are processed by Stripe. We hold your plan, billing status, and credit balance; your card details go to Stripe and are never stored by us.

Device and technical data. Push notification tokens for the devices you enable, and the usual technical logs needed to run and secure the service. Error reports are collected with identifying details scrubbed before they leave the app. We do not use advertising trackers.

We use your information to run your account and the service: connecting employers with locums, showing the right shifts to the right professionals, powering briefings and calendars, generating and delivering invoices on a locum’s instruction, sending the notifications you have enabled (push notifications and transactional email, including employer digest emails), keeping the platform secure, providing support, and improving the product.

We collect only what we need for those purposes, and we do not use your documents or professional details for advertising.

Locum is a bridge, not a mediator: we share information between the two sides of the platform only as you direct. An application you submit is shown to that employer; an invoice you send is delivered to the recipient you choose; chat messages are visible to the parties of that conversation. Public pool statistics (for example, active locums in a region for a sector) are aggregated counts that do not identify you and are shown only above minimum thresholds.

We use a small set of service providers to operate the platform, each receiving only what their function needs: Supabase (database, authentication, and file storage), Vercel (web hosting), Expo, Apple, and Google Firebase (push notification delivery), Google and Apple (sign-in), Resend (email delivery), Stripe (employer billing), and Sentry (error monitoring, with identifying details scrubbed). We may also disclose information where the law requires it, and to a successor entity if our business is sold or reorganised — in which case this policy continues to apply to your information.

We do not sell your personal information.

Our primary database and file storage are hosted in Australia (Amazon Web Services, Sydney). Some service providers listed above process data in other countries, including the United States. Wherever your information is processed, it remains protected by safeguards comparable to those of the New Zealand Privacy Act 2020, through provider agreements and the technical measures described below.

Invoices are retained to meet tax and record-keeping obligations — seven years for New Zealand records and five years for Australian records — even after an account is deleted.

Other personal information is kept while your account is active. If you delete your account, it is first deactivated with a 30-day reactivation window; after that window your personal information is removed or irreversibly de-identified, except records we are legally required to keep (such as the invoices above). Residual copies age out of encrypted backups on a fixed schedule.

You can access, export, and correct your information from within the app, control push notifications per category and device, and delete your account yourself (starting the 30-day window described above). Under the NZ Privacy Act 2020 — and the Australian Privacy Principles for users in Australia — you may also request access to or correction of your personal information by contacting us.

If you are not satisfied with our response to a privacy concern, you can complain to the Office of the Privacy Commissioner (privacy.org.nz) in New Zealand, or the Office of the Australian Information Commissioner (oaic.gov.au) in Australia.

Information is encrypted in transit; documents live in private storage buckets; access to data is enforced row-by-row at the database layer so each user and organisation can reach only their own records; administrative access is least-privilege and administrative actions are audit-logged. No internet service can promise perfect security, but security decisions on Locum default to the conservative option.

Locum is a professional platform for working health-sector professionals and their employers. It is not intended for, and must not be used by, anyone under 18.

We may update this policy as the product and the law evolve. If we make material changes we will notify you in the app or by email before they take effect, and the date at the top of this page will always tell you when it last changed.

Privacy questions and requests: privacy@locum.now, or write to ARISDY LIMITED, 24F Mount Smart Road, Royal Oak, Auckland, New Zealand.