Privacy Policy
1. Who we are
Locu NZ Limited (“locu.nz”, “we”) is the controller of personal information collected through locu.nz. We comply with the Privacy Act 2020 (NZ) and the Information Privacy Principles.
2. Information we collect
- Account: name, preferred name, email, phone, address, region.
- Locum profile: primary role, registration body and number, APC expiry, police-vet status, indemnity status, right-to-work declaration, IRD number, preferred rate, bio.
- Identity and right to work (locums): date of birth, a copy of a government photo ID (a passport, NZ driver licence or Kiwi Access card), and, for visa holders, a copy of the visa and its expiry date. We use these to confirm who you are, that you are 18 or older, and that you may work in New Zealand. Only our verification team sees them; they are never shown to a business.
- Tax residency (locums): whether you are a New Zealand tax resident, and if not, the country you are a tax resident of, plus any IRD certificate of exemption you choose to upload. A business that pays a contractor who is not a New Zealand tax resident may have to deduct tax, so a business you apply to or work for is told your answer and whether you have a certificate. It never sees the certificate itself.
- Ethnicity (locums, optional): the ethnic group or groups you choose, using the Stats NZ census question and groups, or that you prefer not to say. You don’t have to answer, and you can change or remove your answer at any time on your profile.
- Business profile: business name, NZBN, GST number, contact name and role, hire-roles configuration, invoice and payment-reference metadata, and whether you tell us you are a kaupapa Māori or Pacific health provider.
- Sign-up waitlist: if we don’t take your role or type of business yet, your name, email, region and what you’re waiting for. We use them only to tell you when it opens and to remind you a few times after that.
- Shift activity: shifts posted, applications, accepted bookings, check-in/check-out PIN events, ratings.
- Payment data: we invoice businesses for our platform fee and match those payments by reference. A locum’s wage goes straight from the business to the locum: we record when it is reported sent and confirmed received, and never hold it. If you are a locum we store the bank account number you give us, so that your clinic’s payment run can pay your wages into it and so we can pay you any referral bonus you earn. It is never shown to a business you have not worked for. We do not connect to your bank, we never initiate a payment from your account, and we do not store card details on our servers.
- Technical: IP address, device, browser, log data, cookies for session and analytics (Vercel Analytics).
3. How we use it
- To create and verify accounts and meet professional-council requirements.
- To match Locums to shifts within their scope of practice.
- To check that shifts are reaching locums from every community, using ethnicity only in totals that name nobody and can be compared with Health New Zealand’s workforce figures. Your ethnicity has no effect on the shifts you are offered or on who can book you.
- To facilitate bookings, timesheets, invoicing and payments.
- To provide support, prevent fraud, and enforce our Terms.
- To send service emails (verification, shift notifications, invoices) from contact@donotreply.locu.nz; and, with consent, marketing.
- To improve the Platform via aggregated and anonymised analytics.
4. Sharing
We share personal information only as needed to operate the Platform:
- With the counterparty to a shift (e.g. a Business sees applying Locums’ profile and registration info; a Locum sees the Business contact for an accepted shift). A Business never sees a Locum’s date of birth, identity document, visa document or IRD number.
- A Locum’s ethnicity is shared with a Business only if all three are true: the Locum has ticked “Share with kaupapa Māori and Pacific providers I apply to”, we have checked that the Business is a kaupapa Māori or Pacific health provider, and the Locum has applied to that Business. No other Business sees it, and unticking the box stops the sharing straight away. Our own team can see it to provide support and to check our reports.
- With service providers under written agreement: Supabase (database & auth), Vercel (hosting), Resend (email), and analytics providers.
- With professional councils or regulators where required to verify registration or respond to a lawful request.
- Where required by law, court order, or to protect safety.
5. Storage & security
Data is stored on Supabase infrastructure (primarily AU/EU regions) and accessed via row-level security tied to your authenticated role. We use TLS in transit, encrypted backups, and access controls. No system is perfectly secure; we will notify affected users and the Office of the Privacy Commissioner of any notifiable privacy breach as required by the Privacy Act 2020.
6. Retention
We retain account and shift records for as long as your account is active and for up to 7 years thereafter to meet tax, professional and regulatory obligations. Marketing preferences and analytics data are retained for shorter periods. Your ethnicity answer is kept only while your account is open, and removing it on your profile deletes it; the totals we report contain no individual answers. You may request earlier deletion subject to those obligations.
If we decline an application, or it is withdrawn, we delete what it contained 12 months later, except your name, date of birth, email, phone, professional registration body and number, and our decision. We keep those, and the same details of any account we close, so that someone we have declined or removed cannot simply register again. We keep them for as long as they are needed for that purpose and use them for nothing else.
7. Your rights
Under the Privacy Act 2020 you can request access to, and correction of, your personal information. You can also withdraw marketing consent and ask us to close your account. Contact contact@locu.nz. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner (privacy.org.nz).
8. Cookies
We use first-party cookies for authentication and session management, and limited analytics cookies (Vercel Analytics) to understand aggregate Platform usage. You can clear or block cookies in your browser; the Platform will not function without session cookies.
9. Children
The Platform is not intended for anyone under 18. We do not knowingly collect information from children.
10. Changes
We’ll post any updates to this policy here and notify you of material changes by email or in-app at least 14 days before they take effect.
11. Contact
Privacy queries: contact@locu.nz.