Privacy Policy

1. Overview

Falcon Locums (“we”, “us”) is a healthcare staffing and recruitment agency. This Privacy Policy explains how we handle personal data collected through falconlocums.com, our application funnel, and our Candidate Portal. We are committed to transparent, HIPAA-compliant and GDPR-compliant data practices.

2. Data we collect

Candidate data

• Contact information: name, email, phone, location
• Professional information: specialty, licensure, experience, availability
• Documents: CVs, certifications, licenses, and credentials uploaded via the Candidate Portal
• Communications: messages and notes shared with our recruiters

Facility (client) data

• Contact and facility information: name, facility, type, location
• Staffing requirements: roles needed, urgency, coverage dates

3. Legal basis for processing (GDPR)

For individuals in the European Economic Area, we process personal data on the following legal bases:

• Consent: You submit data via our forms and acknowledge this policy.
• Contractual necessity: To match you with assignments or staffing engagements.
• Legitimate interest: To operate our business, prevent fraud, and improve our services.

4. How we use your data

• To match candidates with locum tenens and permanent opportunities
• To scope staffing needs for facility clients
• To perform credentialing and compliance verification
• To communicate with you about assignments and opportunities
• To comply with legal and regulatory obligations

5. Data sharing

We share candidate data with facility clients solely for the purpose of matching and credentialing. We use third-party processors (e.g., CRM, document storage) that are bound by data processing agreements. We do not sell personal data.

6. Data retention

We retain candidate data for the duration of active engagement and for a reasonable period thereafter to support future matching, unless you request deletion. Credentialing documents are retained per regulatory requirements.

7. Your rights

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate data
• Erasure: Request deletion (subject to legal retention obligations)
• Restriction: Limit processing in certain circumstances
• Portability: Receive your data in a structured format
• Objection: Object to processing based on legitimate interest
• Withdrawal of consent: Withdraw consent at any time

To exercise these rights, contact [email protected].

8. International transfers

As a U.S.-based business, we primarily process data in the United States. Where international transfers occur, we rely on appropriate safeguards such as Standard Contractual Clauses.

9. Security

We use TLS encryption for data in transit and store documents in HIPAA-compliant systems. See our Data Handling disclosure for technical details.

10. Changes to this policy

We may update this policy from time to time. Material changes will be posted on this page with an updated revision date.