Privacy Policy
Your privacy is important to us. Learn how we collect, use, and protect your personal information.
Last Updated: October 4, 2026
1. Introduction
Welcome to OnLocum. This Privacy Policy explains how OnLocum ("we," "us," or "our") collects, uses, discloses, and protects your personal information when you use our platform, mobile applications, and services.
OnLocum operates a healthcare workforce management platform providing locum staffing, home-based care coordination, medical transport coordination, and medical logistics services across Kenya and Africa.
By using OnLocum, you consent to the collection and use of your information as described in this Privacy Policy. If you do not agree with this policy, please do not use our services.
2. Information We Collect
2.1 Information You Provide
- Account Information: Name, email address, phone number, date of birth, gender, profile photo
- Identity Verification: Government-issued ID, professional certifications, and medical licenses
- Payment Information: Mobile money wallet information, bank account details
- Professional Information: CV/resume, education history, work experience, skills, certifications (for healthcare professionals and service providers)
- Facility Information: Business name, registration number, address, department information (for healthcare facilities)
2.2 Information We Collect Automatically
- Location Data: GPS coordinates, IP address, device location (for shift check-ins, medical operations, and emergency coordination)
- Device Information: Device type, operating system, unique device identifiers, mobile network information
- Usage Data: App interactions, features used, search queries, booking history, and shift history
- Communication Data: In-app messages, customer support interactions, push notification preferences
2.3 Information from Third Parties
- Social login providers (Google)
- Payment gateway providers (M-Pesa; Flutterwave for card payments, where enabled)
- Maps and location services (Google Maps)
3. How We Use Your Information
We use your information for the following purposes:
3.1 Service Delivery
- Processing bookings, shift requests, and service requests
- Matching healthcare facilities with qualified professionals
- Facilitating home-based care, emergency dispatch, and medical logistics coordination
- Real-time location tracking during service delivery and shift check-ins
- Payment processing and invoicing
3.2 Safety and Security
- Verification of worker documents
- Fraud prevention and detection
- Emergency response coordination (ambulance dispatch)
- Incident investigation and dispute resolution
3.3 Communication
- Service updates and notifications
- Customer support and assistance
- Marketing communications (with your consent)
- Important policy updates
3.4 Platform Improvement
- Analytics and usage patterns
- Feature development and optimization
- A/B testing and performance monitoring
4. Data Sharing and Disclosure
We share your information with third parties only as described below:
4.1 Service Matching
- Healthcare facilities see limited professional information (name, photo, credentials)
- Professionals see facility information for shift opportunities
- Assigned transport/logistics providers may see pickup, drop-off, and contact details needed to fulfill a request
4.2 Third-Party Service Providers
- DigitalOcean: Application hosting, managed database (India), database backups (Singapore), and our operations agents (Frankfurt)
- Vercel: Hosting for our web front ends
- Cloudflare: DNS, content delivery, and TLS termination
- Google Cloud Storage: File storage and delivery
- Amazon SES: Transactional email delivery (Mumbai)
- Listmonk: Email campaign management
- Firebase: Push notifications
- Africa's Talking: SMS notifications
- M-Pesa & KopoKopo: Payment processing
- Flutterwave: Card payment processing, where enabled
- PubNub: Real-time messaging
- Google Maps: Location services
- Sentry: Error monitoring
- PostHog & Vercel Speed Insights: Product and performance analytics
- AI service providers: AI-assisted features send content to the providers below. Requests may carry clinical or operational content; see our data protection page for what is and is not removed before a request leaves Kenya
- Moonshot AI (Kimi): Support chat in the OnLocum apps (your display name, user type, recent chat messages and your question), and, in FlowMed, import analysis and denial scoring where those features are used
- Google (Gemini): In FlowMed, clinical, billing and operations AI features, such as clinical documentation and decision support, daily summaries and handovers, radiology image analysis, claim and invoice review, email handling, support assistance and import mapping, where a facility uses those features. Labelled patient identifiers (such as name, record number, phone, ID number and date-of-birth fields) are removed from the text before sending; clinical content, including free-text notes that may still mention a patient, and any images, is still sent
- Xiaomi MiMo: Operational summaries for our team, which include the name, email address and message subject of people who contact us, such as demo requesters. Where a facility or platform administrator selects it, MiMo also receives clinical text in FlowMed (never images)
- OpenRouter: A fallback route for those operational summaries, so the same content may pass through it
- OpenAI: Only where a facility configures its own account for FlowMed AI features
- Google Drive: A client-side-encrypted copy of database backups. Google holds ciphertext only; the key never leaves us
4.3 Legal Requirements
We may disclose your information if required by law, court order, or government regulation, or to protect the rights, property, or safety of OnLocum, our users, or the public.
4.4 Business Transfers
In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity.
5. Data Security
We implement industry-standard security measures to protect your information:
- Encryption: Our servers accept TLS 1.2 or higher (TLS 1.3 where supported) for data in transit; selected sensitive fields (such as national ID numbers and two-factor secrets) are encrypted in the application; database backups are kept in two locations, and the Google Drive copy is encrypted before it is uploaded
- Access Controls: Role-based access, multi-factor authentication for admins
- Secure Infrastructure: DigitalOcean managed hosting and databases, behind Cloudflare
- Security Reviews: Internal security audits of our code
- Incident Response: Breach notification procedures in compliance with regulations
However, no method of transmission or storage is 100% secure. We cannot guarantee absolute security of your information.
6. Data Retention
We retain your information for the following periods:
- Active Accounts: Throughout account lifetime and 1 year after deletion (for legal compliance)
- Trip/Shift History: 5 years (for tax and legal requirements)
- Payment Records: 7 years (for financial auditing)
- Communication Logs: 2 years
- Location Data: 30 days (unless part of incident investigation)
You may request deletion of your data at any time (see Section 7).
7. Your Rights (GDPR Compliance)
Under GDPR and Kenya Data Protection Act 2019, you have the right to:
7.1 Access
Request a copy of your personal information we hold (data portability).
7.2 Correction
Update or correct inaccurate information in your account settings.
7.3 Deletion
Request deletion of your account and associated data (subject to legal retention requirements).
7.4 Objection
Object to processing of your data for direct marketing purposes.
7.5 Restriction
Request restriction of processing under certain circumstances.
7.6 Withdrawal of Consent
Withdraw consent for processing (e.g., marketing communications, location tracking).
To exercise these rights, contact us at privacy@onlocum.com.
9. Third-Party Services
OnLocum integrates with third-party services. We are not responsible for their privacy practices. Please review their policies:
10. Children's Privacy
OnLocum is not intended for users under 18 years of age. We do not knowingly collect information from children. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at privacy@onlocum.com.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes via:
- Email notification
- In-app notification
- Prominent notice on our website
Continued use of OnLocum after changes constitute acceptance of the updated policy.
12. Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or your personal information, please contact us: