Privacy policy

Last updated 28 October 2026

SendRight is an app for Windows made by Computer Services Group ("CSG", "we", "us"). Australian practices use it to split, password-protect and send sensitive documents such as patient records. This policy explains what information SendRight handles, where it goes and how we protect it. It also covers what SendRight does with your Google or Microsoft 365 account if you connect one. We follow the Australian Privacy Principles in the Privacy Act 1988 (Cth).

1. What stays on your computer

• The documents you prepare. SendRight works on copies of files you choose. It splits and encrypts them on your computer and saves them in a folder you choose. The Clean up step permanently deletes those copies. SendRight never changes the original files or your clinical or practice software.
• Practice details you enter in Practice setup: practice name, phone, email, privacy officer and email signature. They are stored in a settings file on the computer and shared by its users.
• Your own settings, such as where files are saved and how you usually send the password.
• Sign-ins for a connected Google or Microsoft 365 account, and any SMS activation key, are encrypted with Windows' data protection (DPAPI). Only your Windows account, or only that computer, can read them.
• The privacy guide confirmation: the name you type when you confirm you've read the guide.

None of this is sent to CSG.

2. What leaves your computer, and where it goes

What	Goes to	When
Emails with the prepared documents	Your email provider: Microsoft or Google if you connect your account (sections 3 and 4), otherwise whichever email app you use	When you send them
The password only, never the documents or any names	Password Pusher (eu.pwpush.com, stored encrypted in the EU, or your practice's own server), which makes a link that shows the password a few times and then expires	Only if you choose "Email a secure link"
The recipient's mobile number, the password, the practice name and, if entered, the requestor's reference	CSG's SMS gateway in Australia, which passes them to our SMS provider (ClickSend) to send the text. The gateway doesn't store the password. It logs the time, the last three digits of the number and the delivery status.	Only if you choose "Text message (SMS)"
The domain part of an email address (for example "gmail.com")	Your own computer's DNS servers, to look up which email provider it uses and so how big each email can be. Not CSG.	When you type a recipient or practice email
Your SMS activation key	CSG's SMS gateway, to check the subscription	When you activate SMS
Bug reports and feature requests	CSG, by email or our contact form, containing only what you choose to write	Only if you send one

SendRight has no analytics or advertising, and doesn't send usage data to CSG.

3. Google user data (Gmail and Google Workspace)

Connecting a Google account is optional (Menu > Email account in the app). It lets SendRight send the prepared emails from your own Gmail or Google Workspace address, so they appear in your Sent folder.

What SendRight asks Google for

• Your email address (the openid and email permissions), to show which account is connected and to send from it.
• Permission to send email on your behalf (gmail.send). With this permission alone, SendRight can't read, search, change or delete any email in your mailbox, or see your contacts, files or calendar.

How SendRight uses Google user data

• To send the emails you ask it to send, each with its attached document, to the recipient you entered and checked. It also sends the separate email with the password link, if you choose that way of giving the password. Nothing is sent until you click Send.
• To show your email address in the app, and to work out how big each email can be for Gmail.

SendRight uses Google user data for nothing else. In particular, Google user data is not used for advertising, not sold, not given to data brokers or information resellers, not used to decide creditworthiness or for lending, and not used to develop, train or improve AI or machine-learning models.

Where it is stored

• The sign-in Google gives SendRight (a refresh token) is stored only on your computer, encrypted with Windows' data protection for your Windows account. The short-lived access tokens made from it are kept only in memory while the app runs.
• Emails go directly from your computer to Google over an encrypted (HTTPS) connection. CSG's servers are not involved, and CSG never receives your Google sign-in, your email address or the emails you send.
• Copies of the sent emails are kept by Google in your own account, under your agreement with Google.

Sharing

SendRight doesn't share Google user data with CSG or anyone else. The emails go to the recipients you chose, because sending them is what you asked for. No person at CSG can see your Google user data. If you ask us for help, we will never ask for your Google password or sign-in.

Your control and deleting the data

• In SendRight, Menu > Email account > Disconnect deletes the stored sign-in from your computer and asks Google to cancel it.
• You can also remove SendRight's access at any time from your Google Account, at myaccount.google.com/connections.
• Google Workspace administrators can control or block SendRight in the Google Admin console (Security > API controls).

4. Microsoft 365 account data

Connecting a Microsoft 365 work or school account, or a personal Outlook.com or Hotmail account, is optional (Menu > Email account). SendRight signs in with Microsoft's sign-in page and asks for:

• Your profile's email address (User.Read), to show which account is connected and to send from it.
• Permission to send email (Mail.Send).
• Permission to create email (Mail.ReadWrite). Microsoft only lets apps attach files bigger than 3 MB by first saving the email as a draft. SendRight uses this permission only to create its own email, attach the document, send it, and delete the draft if sending fails. It doesn't read, search or change your other email.
• Staying signed in (offline_access), so you don't sign in every time.

As with Google, the sign-in is stored only on your computer, encrypted for your Windows account, and emails go directly from your computer to Microsoft. CSG never receives them. Disconnect in the app removes the sign-in from your computer. Your organisation's administrator can remove SendRight's access in Microsoft Entra (Enterprise applications).

5. How we protect information

• Documents are encrypted with AES-256 (PDF, Word, Excel, PowerPoint and zip encryption) before they leave your computer, and the password is never put in the same email.
• Sign-ins and keys stored on the computer are encrypted with Windows' data protection (DPAPI).
• All connections to Microsoft, Google, Password Pusher and CSG's gateway use HTTPS.
• CSG's services that handle personal information (the SMS gateway) are hosted in Australia. Access is limited to staff who need it, and we don't log passwords.

This website

www.sendright.com.au uses no cookies, analytics or tracking scripts, and loads nothing from other websites. It is hosted on Vercel, a United States company that serves the pages from data centres around the world and processes visitors' IP addresses to deliver them and protect the site from attacks. If you email or phone us, we use what you tell us to answer you and keep it with our support records.

6. How long information is kept, and deleting it

• On your computer: prepared copies until you delete them in Clean up. Settings and sign-ins until you change them, click Disconnect, or remove SendRight and its settings folders (%LOCALAPPDATA%\PDFCompressor and C:\ProgramData\SendRight).
• Password links: deleted by Password Pusher when the link expires or reaches its view limit.
• SMS: the gateway's delivery log (time, last three digits, status) is kept for up to two years for billing and support. The password isn't stored.
• Google and Microsoft account data: CSG holds none. What SendRight keeps on your computer is deleted when you click Disconnect.

7. Information held outside Australia

If you choose a secure password link through eu.pwpush.com, the encrypted password is held in the European Union until the link expires. Emails you send through Microsoft 365 or Google are handled under your own agreement with that provider, in the locations they use for your account. Text messages are delivered by our SMS provider, ClickSend; its privacy policy explains where it processes them. CSG does not otherwise send personal information overseas.

8. Access, correction and complaints

You can ask what personal information CSG holds about you, ask us to correct it, or make a complaint, by contacting our privacy officer (section 10). We will respond within 30 days. If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

The patient and client information in the documents you send belongs to your practice's records. Requests about it should go to your practice.

9. Changes to this policy

We will update this page when SendRight changes how it handles information, and change the date at the top. If a change affects how SendRight uses Google or Microsoft account data, the app will tell you and ask you to agree before the new use starts.

10. Contact us

Privacy officer, Computer Services Group
Email: support@computer-services.com.au (subject "Privacy")
Phone: (07) 5551 2333