GP Locum: Invoices & Pension

GP Locum: Invoices & Pension — shown as “GP Locum” once it is on your home screen — is an app for GP locums. It records your sessions, raises your invoices, fills your NHS Pension Form A and Form B, and works out what to set aside for tax. This page explains what the app does with your information. The short version is that it keeps it on your phone, and the only place it will ever copy it to is an account of your own.

Everything you enter stays on your phone

There is no account with us, no sign-in to us and no server behind this app. Your name and address, your bank details, your National Insurance, GMC and NHS Pension membership numbers, your date of birth, your signature, the practices you work at, every session you log, your fees, your distances and your expenses are all stored in the app’s own storage on your device.

None of it is uploaded to us. We cannot see it, and there is no copy of it to hand over to anyone else. It also means that if you delete the app or lose the phone, that data is gone — which is why the app offers two backups under More → Backup, both of which put the copy somewhere of yours: a file you keep where you like, or the Google Drive backup described next.

Backing up to your own Google Drive

The app can keep a copy of everything in Google Drive, so that a lost or replaced phone is an inconvenience rather than a year’s paperwork gone. Two things about it matter more than any of the detail below: it is off until you switch it on, and the Drive it copies to is yours. Your phone talks to Google directly. Nothing passes through us, because there is nothing of ours for it to pass through.

What signing in tells the app

Connecting Drive signs you into Google through your phone’s own Google sign-in, and you choose which account. The app is told the email address of the account you picked, and uses it for one thing: showing you on the Backup screen which account is being backed up to. “Backing up to Google Drive” with no way to see whose Drive is fine right up until someone has two accounts. That address is held on the phone with everything else and is not sent anywhere, including to us.

What is uploaded

A folder called GP Locum is created in your Drive, and two kinds of thing go into it. The invoices, Form As, Form Bs and income statements the app produces are filed there by kind and month. Alongside them, in GP Locum / App data, sits a single file holding the app’s own data: your details, your practices, your sessions, fees, distances, expenses and your signature. That file contains the personal and financial details listed above, including your bank details and NI number, because a backup that left them out would not put your phone back.

It keeps itself up to date as you work — a few seconds after a change settles, rather than on every keystroke. Restoring is the one direction that never happens on its own: overwriting a phone from Drive is destructive and occasionally the wrong way round, so the app asks first.

How little access the app asks for

The app holds one Drive permission, drive.file, which grants access to files the app itself created and to nothing else in the account. It cannot read your other documents, cannot list your Drive, and cannot delete anything it did not write. It has no access to Gmail, contacts, photos or anything else in that Google account.

Stopping it

More → Backup → Stop backing up signs out and revokes the app’s access to your Google account, so it can no longer reach anything there. What is already in Drive stays where it is: it is yours, and deleting a locum’s invoices because they turned a setting off would be indefensible. Deleting it is a folder in your own Drive and a couple of taps — deleting your data walks through it.

Google user data, and what it is never used for

The app’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In plain terms, and without exception:

• Google user data is used only to provide the backup and restore you switched on, and for nothing else.
• It is never transferred to anyone, sold, or used for advertising, advertising profiling, or credit assessment.
• It is never used to train or improve any generalised or personalised artificial intelligence or machine learning model.
• No human reads it. It is not read by us at all — it stays between your phone and your Drive, and we have no route to it.

The documents it produces

Invoices, Form As, Form Bs and income statements are written as PDF files into the app’s own storage on your phone, and copied to your Drive folder if you have that switched on. They go anywhere else only when you send them — through your phone’s share sheet, or into a folder you have chosen on Android. Where they go after that is between you and whichever app you picked; we are not told which one it was, or whether the file arrived. The app records that you sent a document, not where it went.

What else leaves your phone

Four things, and nothing else. Beyond the Drive backup above, the app makes no other network request of any kind.

All four are ordinary web requests, so the service at the other end sees the request’s IP address, as it would from any app or browser. None of them is sent your name, your diary, your fees, your documents, or any identifier for you or the phone, and none of them is told what the answer is for.

1. Looking up a practice

When you search for a GP practice while adding one, the practice name or ODS code you typed is sent to the NHS Organisation Data Service, an open NHS directory, so the app can fill in the address and the ODS code that Form A needs. Nothing else goes with it.

2. Looking up an employing authority code

When you search for a practice’s employing authority, the practice name or postcode you are searching for is sent to the NHSBSA employer contacts lookup. Again, nothing else goes with it.

3. Working out your mileage

To itemise your mileage the app needs to know how far each practice is from home, and it works that out for you rather than asking. Your home postcode and your practices’ postcodes are sent to postcodes.io, a free, key-less service built on the Ordnance Survey and ONS open data, which returns their coordinates. The app then calculates the distance itself.

Unlike the other three, this one happens on its own — whenever a practice in your diary has no distance recorded yet. Postcodes are the only thing sent: not your name, not your diary, not your fees, and no identifier for you or the phone. A postcode is still personal data, which is why it is set out here and declared on the store listing rather than treated as a technicality. Your home postcode comes from the address you entered, or from the box on the Mileage screen; leave both blank and this never runs. Every distance stays editable, and one you type is never overwritten.

4. The contact form

If you use Contact us inside the app, the name, email address and message you type are sent to this website and emailed onward so they can be read and replied to, along with the version number of the app so a bug report can be placed. They are used only to answer you, are never added to any mailing list, and are not shared with anyone else. This is the same route as the contact form on this site: carried by Cloudflare, which hosts the site, and sent as an email by Resend.

The legal basis is legitimate interests — answering someone who has written in. The email is kept for up to 12 months after the conversation ends and is then deleted, or sooner if you ask.

Your calendar

The app can add your locum sessions to your phone’s calendar, so they show up in Google Calendar or Apple Calendar alongside everything else. This is off until you switch it on, and switching it on asks your phone’s permission first.

The permission is used for two things only: to list your calendars so you can choose which one to write to, and to create, update and remove the events for your own sessions. The app does not read your existing appointments, and it never touches an event it did not create. It goes through your phone’s own calendar rather than through any Google account the backup is signed into, and nothing about your calendar leaves the phone. Turning the sync off removes the events it added.

No analytics, no tracking, no ads

The app contains no analytics, no advertising, no crash-reporting service and no tracking of any kind. It does not read your device identifier or advertising ID, does not use cookies, does not know how often you open it, and does not report anything back about how you use it. Nothing is collected for our own purposes, so there is no profile of you anywhere to sell, share or lose.

Deleting your data

There is no account with us to close, so deleting means clearing the places the data actually sits: the phone, your Drive folder, the app’s access to your Google account, and any email you have sent us. Every one of them is a step you can take yourself, and deleting your data gives the steps, what is held where, and for how long.

Your rights

Under UK GDPR you have the right to see, correct and delete personal data held about you. In practice there is almost nothing to ask us for: your data is on your phone and, if you switched the backup on, in your own Drive — both under your control, and both deletable without us. The one exception is a message you have sent through the contact form, which exists as an email. Ask through any of the routes below and it will be deleted. If you are unhappy with how a request is handled, you can complain to the Information Commissioner’s Office.

Children

The app is a professional tool for GPs. It is not directed at children and is not designed for or marketed to anyone under 18.

Changes to this policy

If the app ever starts doing something with your information that this page does not describe, this page will be updated before that version is released, and the date at the top will change.

Questions

Email [email protected], use the contact form, or use Contact us inside the app. All three reach the same place.