Privacy Policy

This Privacy Policy explains how Accipe ("we", "us", "our") collects, uses, and protects information when you use the LocumBook mobile application and website at https://locumbook.accipe.co.uk.

LocumBook is operated by Accipe. We are the data controller for personal data described in this policy.

1. Summary

• Your locum session, invoice, mileage, and pension data stays on your device by default.
• Cloud sync is optional and requires Pro, sign-in, and your explicit opt-in. Document vault files (Pro) stay on this device and are never synced or backed up to iCloud or Android auto-backup.
• We use Google Firebase for analytics, crash reporting, and performance monitoring in release builds. We also use Google Analytics for Firebase to measure whether our Google Ads campaigns lead to app installs, free trials, and subscriptions. In the UK, the EEA, and Switzerland, we only do this ad measurement if you allow it. Elsewhere it is on by default. Wherever you are, you can change your choice at any time.
• LocumBook does not show ads in the app and does not track you across other companies' apps or websites.
• We do not sell your personal data.

2. Data controller and contact

Accipe is the data controller for personal data processed through LocumBook. For privacy enquiries, contact support@accipe.co.uk or use our contact page.

ICO registration

Accipe (GP Accipe Ltd) is registered with the Information Commissioner's Office (ICO) as a data controller. Registration reference: ZC256019. Public register entry: https://ico.org.uk/ESDWebPages/Entry/ZC256019

3. Important principle: your data stays local by default

LocumBook is designed so your clinical and financial session data remains on your device by default. We do not upload your session, invoice, mileage, or pension records to our servers unless you have an active Pro subscription, sign in with Apple or Google, and explicitly opt in to cloud sync in Settings.

4. Information we collect

4.1 Data stored on your device (Free and Pro)

When you use the app, the following data is stored locally on your phone or tablet:

• Locum sessions (dates, hours, fees, practices, mileage, parking, notes)
• Invoice and payment status
• Mileage and expense records
• NHS pension-related data you enter
• Your home postcode and address (for mileage calculations), if you provide them
• App settings and preferences
• Encrypted local backups you create (.lbkbackup)
• Document vault files (Pro) — indemnity, DBS, and similar certificates you upload. These files stay on this device only: they live in the app sandbox, are excluded from iCloud and Android auto-backup, and are not included in encrypted backups or cloud sync. Deleting your account wipes the vault. Uninstalling the app or changing phones also removes them.
• Pro receipt photos (optional) — if you attach a receipt to a deductible expense while signed in, the image is sent securely to Google Cloud Vision to read the text (merchant, amount, date). Photos are not stored after reading; suggestions are shown in the app for you to confirm before saving.

Session, invoice, and financial data remains on your device unless you enable cloud sync. Document vault files are never synced.

4.2 Account and subscription data (when you sign in)

When you sign in with Apple or Google to use Pro or cloud sync, we receive:

• A unique account identifier from your identity provider (via Supabase Auth)
• Your email address, where your identity provider shares it (Apple may provide a private relay address)
• Your display name, where your identity provider shares it
• Your subscription status (Free, Pro, trial, or lifetime) via RevenueCat

We do not receive or store your identity provider password. Sign-in is used to verify your subscription and, if you opt in, to associate cloud sync data with your account. We do not upload your session or financial records without your explicit consent to sync.

4.3 Cloud sync data (Pro, sign-in, and opt-in only)

If you enable cloud sync, your app data (sessions, practices, expenses, and related records) is synchronised via Supabase and associated with your authenticated account. Document vault files are not included in cloud sync. You can disable sync and delete cloud data from Settings → Data management.

4.4 Device permissions

The app may request the following device permissions. You can decline or revoke them in your device settings:

• Calendar (read-only): to import locum shifts from your device calendar or iCal feeds (e.g. Lantum). We read calendar events for import only; we do not modify or delete your calendar events.
• Notifications: to show local session reminders, unpaid invoice alerts, and (for Pro) document expiry reminders scheduled on your device. These reminders do not require uploading your session or document files to our servers.
• Biometrics / device PIN: to lock the app. Biometric data is processed by your device's operating system; we do not store your fingerprint or face data.

LocumBook does not request access to your precise GPS location. Mileage is calculated from postcodes and addresses you enter, not from continuous location tracking.

4.5 Google Maps services

If you use postcode lookup or automatic mileage calculation, the app sends UK postcodes you enter to Google Maps Platform (Places Autocomplete and Distance Matrix APIs) to suggest addresses and calculate driving distances. Google's privacy policy applies to that processing.

4.6 Analytics, diagnostics and ad measurement (Firebase)

To keep LocumBook reliable and to understand how people find it, we use Google Firebase in release and profile builds (not in debug builds).

Analytics and diagnostics

• App interactions and screen views (Google Analytics for Firebase)
• Crash reports and error diagnostics (Firebase Crashlytics)
• App performance metrics such as start-up and screen load times (Firebase Performance Monitoring)

Ad measurement and attribution

We advertise LocumBook through Google Ads. To see which campaigns lead to people installing the app and starting a trial or subscription, Google Analytics for Firebase records:

• app installs and first opens
• these in-app events: trial started (when you start a free trial), purchase (when you buy a subscription), and paid (when a paid subscription is confirmed)
• for those events, the price, currency, and product (for example, which subscription plan)

RevenueCat, which manages our subscriptions, also sends subscription renewals and conversions (for example, a trial turning into a paid subscription) to Firebase from its servers. These are linked to the app's Firebase app instance identifier so they can be counted against the right install.

What this data does and does not include

This data does not include the contents of your session, invoice, mileage, or pension records, or your Document vault files. It may include app instance identifiers, device model, operating system version, general usage patterns, the subscription event details listed above, and an approximate location (such as country or region) that Google may work out from your device's IP address. We use it to diagnose problems, improve the app, and measure how well our advertising works.

Who receives it

This data is processed by Google: Google Ireland Limited for users in the UK, the EEA, and Switzerland, and Google LLC (USA) and its affiliates. Google processes Firebase data on our behalf as our service provider. Where ad measurement data is shared with Google Ads, Google may also use it in line with its own terms and privacy policy (https://policies.google.com/privacy).

Remote push notifications (where enabled): if you are a Pro subscriber, signed in, and have notifications enabled, the app may register a Firebase Cloud Messaging (FCM) device token with our servers so we can send optional alerts (for example, unpaid invoice digests). You can disable notifications in Settings at any time.

4.7 Support enquiries

When you contact us through the in-app or website contact form, we process the name, email address, topic, and message you provide. Messages are delivered via our email provider (Resend) to support@accipe.co.uk so we can respond to your enquiry. The app may append your app version to support messages to help us diagnose issues.

4.8 Website usage

Our marketing website may collect standard server logs (IP address, browser type, pages visited) through our hosting provider. We do not use the website to collect app session data.

4.9 Ad measurement choices, iOS and no in-app ads

Your choice (UK, EEA and Switzerland)

If you are in the UK, the EEA, or Switzerland, LocumBook asks you once, after you finish setting up the app, whether you are happy for us to use ad measurement. We work out your region from your device's language and region settings. If we can't tell your region, we treat you as being in the UK or EEA and ask you.

• If you say yes, Google Analytics for Firebase may use your app data to measure and attribute our Google Ads campaigns as described in section 4.6.
• If you say no, ad storage, ad user data, and ad personalisation stay switched off. Your data is not used for ad measurement or ad personalisation. Basic analytics (such as screen views and app stability) continues so we can keep the app working well.

Everywhere else

If you are outside the UK, the EEA, and Switzerland, ad measurement is on by default and we don't show the question. You can turn it off at any time.

Wherever you are, you can change your choice at any time in Settings → About → Ad measurement.

iOS: no cross-app tracking

On iPhone and iPad, LocumBook does not track you across apps or websites owned by other companies and does not collect your device's advertising identifier (IDFA), so it does not show Apple's App Tracking Transparency ("Allow … to track your activity") prompt. To see which campaigns lead to installs, we rely on Apple's SKAdNetwork. SKAdNetwork gives us aggregated, privacy-preserving results that do not identify you or your device.

No ads in the app

LocumBook does not show any advertising inside the app. Ad measurement is only about understanding how our own ads elsewhere lead people to LocumBook.

5. How we use your information

• Provide and maintain the LocumBook app and website
• Process and verify Pro subscriptions
• Enable optional cloud sync when you opt in
• Calculate mileage and suggest postcodes when you use those features
• Send local or remote notifications you have enabled
• Respond to support requests
• Monitor app stability, fix bugs, and improve performance
• Measure and attribute installs, trials, and subscriptions from our Google Ads campaigns (with your consent in the UK, the EEA, and Switzerland)
• Comply with legal obligations

6. Legal bases (UK GDPR)

We process personal data on the following bases:

• Contract: to provide the app, subscriptions, and support you request
• Consent: for optional cloud sync, calendar import, notifications, ad measurement and attribution (including sharing ad-related data with Google), and any marketing communications (if offered). You can withdraw consent for ad measurement at any time in Settings → About → Ad measurement.
• Legitimate interests: to improve app reliability, prevent fraud, respond to enquiries, and analyse usage through basic analytics (for example, screen views, crash reports, and performance data), balanced against your rights
• Legal obligation: where required by law

7. Third-party services

We use trusted third parties to operate LocumBook:

• Supabase — authentication and optional cloud sync
• RevenueCat — subscription and purchase management. RevenueCat also sends subscription events (such as renewals and conversions) to Google Analytics for Firebase from its servers for analytics and ad measurement.
• Apple Sign In / Google Sign In — account authentication
• Apple App Store / Google Play — app distribution and payment processing. Apple's SKAdNetwork is used for aggregated install attribution on iOS.
• Google Firebase (Google Ireland Limited and Google LLC) — Analytics (including ad measurement and attribution for our Google Ads campaigns, with consent in the UK, the EEA, and Switzerland), Crashlytics, Performance Monitoring, and (where enabled) Cloud Messaging for push notifications
• Google Ads (Google Ireland Limited and Google LLC) — may receive install and subscription conversion data from Google Analytics for Firebase so we can measure our ad campaigns (only with your consent in the UK, the EEA, and Switzerland)
• Google Maps Platform — postcode autocomplete and driving distance calculations when you use those features
• Resend — delivers subscription notices and messages you send through the in-app and website contact forms

These providers process data under their own privacy policies. Some may process data outside the UK. We recommend reviewing their policies for details on international transfers and security.

8. Data retention

• Local app data remains on your device until you delete it or uninstall the app. Document vault files are also wiped if you delete your account.
• Cloud sync data is retained while sync is enabled; you may delete it from Settings.
• Account and subscription records are retained as long as needed to provide the service and meet legal requirements.
• Support messages are retained for as long as needed to handle your enquiry and maintain a record of correspondence.
• Google Analytics for Firebase keeps event-level data (including ad measurement events) for 2 months and user-level data for 14 months. Standard reports show aggregated totals that do not identify you, and these are not covered by these retention periods.
• Crashlytics and Performance Monitoring data are retained according to Google's default retention periods for those services.

9. Your rights

Under UK GDPR, you may have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion of data we hold about you
• Restrict or object to certain processing
• Data portability (where applicable)
• Withdraw consent (for consent-based processing such as cloud sync or ad measurement)
• Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk

To exercise these rights, contact support@accipe.co.uk. You can also delete local data by uninstalling the app, remove cloud data from Settings, change your ad measurement choice in Settings → About → Ad measurement, and manage subscriptions through the App Store or Google Play. Deleting your account also wipes Document vault files on this device.

10. Security

We use encryption for local backups and cloud sync. No method of transmission or storage is completely secure, but we implement appropriate technical and organisational measures to protect your data.

11. Children

LocumBook is intended for professional locum clinicians aged 18 and over. It is not directed at children. We do not knowingly collect data from anyone under 18.

12. International transfers

If you sign in, enable cloud sync, use Google Maps features, contact us, or use the app with analytics or ad measurement active, your data may be processed in countries outside the UK (including the United States) by our service providers, including Google LLC and RevenueCat. Where required, we rely on appropriate safeguards recognised under UK data protection law. Depending on the provider, these may include the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU standard contractual clauses (SCCs), the EU SCCs, or UK adequacy regulations (such as the UK–US data bridge).

13. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version on this page with a revised "Last updated" date. Material changes may also be communicated in the app where appropriate.

14. Disclaimer

LocumBook is a financial tracking tool. It does not provide tax, legal, medical, or employment advice. Always verify figures with HMRC guidance or a qualified professional.

15. Contact

Questions about this Privacy Policy? Email support@accipe.co.uk or visit our contact page.