How SendRight protects documents and personal information
What happens to a document from the moment you add it, where each piece of information goes, and how SendRight supports your obligations under the Privacy Act 1988.
Documents stay on your PC
SendRight is a Windows app, not a cloud service. It reads the files you choose, protects copies of them and saves those copies on the PC. Documents leave the PC only in the emails you send. If you connect Microsoft 365 or Google, those emails go straight from the PC to Microsoft or Google over an encrypted connection. Computer Services Group never receives your documents or your emails.
Encryption
| File | How it's protected | Opens with |
|---|---|---|
| PDF, and photos or scans made into a PDF | PDF AES-256 encryption (qpdf) | Any PDF reader |
| Word, Excel, PowerPoint | Office agile encryption: AES-256, SHA-512, 100,000 key-derivation rounds | Microsoft Office, including the phone apps |
| Anything else, or one zip for everything | AES-256 zip encryption | Mac: double-click. Windows: 7-Zip |
Every protected file is reopened before it's saved, to check that the password opens it and that nothing else does. SendRight never uses the old "ZipCrypto" zip passwords, which free tools can crack.
The password never travels with the file
- Text message: sent through CSG's SMS gateway, hosted in Australia, which passes it to the SMS provider and doesn't store the password.
- Secure link: only the password is sent to Password Pusher, stored encrypted, and deleted when the link expires or reaches its view limit. Practices can use their own Password Pusher server. The link goes by separate email, or by Signal or WhatsApp from the practice's phone. The password itself is never put in a chat.
- Phone or in person: SendRight shows the password with a read-out spelling, and asks staff to confirm who they're speaking to.
Email accounts
If staff connect Microsoft 365 or Google, SendRight asks only for what sending needs. For Google, that's permission to send email, with no access to read the mailbox. For Microsoft 365, it's permission to create and send email, because Microsoft requires a draft for attachments over 3 MB. The sign-in is stored on the PC, encrypted with Windows' data protection for that Windows user, and never on CSG's servers. Disconnect removes it.
No tracking
The app has no analytics, advertising or usage reporting. This website uses no cookies and no tracking scripts.
The Privacy Act and the Australian Privacy Principles
SendRight is a tool for the moment a document leaves the practice. How it supports the APPs:
| Principle | How SendRight helps |
|---|---|
| APP 1: open and transparent management | A staff privacy guide explains the practice's obligations at the front desk. Staff confirm it once a year. |
| APP 6: use and disclosure | Staff choose why each release is allowed, third-party releases need confirmed approval, and the reason goes in the disclosure record. |
| APP 8: cross-border disclosure | Documents aren't sent overseas by SendRight. They go only to the recipient you enter, through your own email provider. |
| APP 11: security of personal information | AES-256 encryption, the password by another route, recipient checks, and permanent deletion of the copies after sending. |
| Notifiable Data Breaches scheme | The staff guide covers what to do straight away if something goes to the wrong person, and when the OAIC must be told. |
Health practices in NSW also have the Health Privacy Principles, which the staff guide covers. No tool makes a practice compliant by itself. Your policies and the decisions staff make about who may receive records still apply.
ISO/IEC 27001
SendRight is made by Computer Services Group, an ISO/IEC 27001 certified company. CSG runs an information security management system certified to ISO/IEC 27001, the international standard for information security. Certificate details are available on request.
Reporting a security issue
If you think you've found a security problem in SendRight, email support@computer-services.com.au with "Security" in the subject. Please don't include patient or client information. Our security.txt has the details.
For how we handle personal information, see the privacy policy.
Try SendRight free during the preview
SendRight is in preview for Australian practices. Ask for a copy and we'll help you set it up, usually in a few minutes per PC.