Privacy policy

Operated by Collabico Canada Inc., British Columbia, Canada.

SealDrop lets businesses — clinics, healthcare practitioners, law firms, brokers and others — send people a secure link to upload documents and, if the business chooses, fill in a form. The business decides what to ask for and is responsible for your information; SealDrop stores and delivers it for that business, in Canada, and deletes it shortly after the business has filed it.

Who is responsible

• The business that sent you the link (“the organization”) is responsible for your personal information under the privacy law that applies to it — for example PIPEDA, British Columbia’s Personal Information Protection Act (PIPA), or a provincial health privacy law for clinics and practitioners. Questions about your records, corrections or access go to the organization.
• SealDrop is the organization’s service provider. We only use your information to provide the service to that organization, under a written agreement with them. We never sell it, use it for advertising, or combine it with other data.

What we handle

• Your name and email and/or mobile number, entered by the organization — to send you its link and reminders.
• Files you upload and answers to the organization’s form (which may include your date of birth, or a Personal Health Number if a clinic asks) — to deliver them to the organization.
• Your IP address and when you used the link — for security, abuse limits and the organization’s audit trail.
• For the organization’s staff: name, work email, role, sign-in times and IP address — for accounts, security and audit.

We do not use cookies or trackers on the upload page or this website.

Emails and text messages

Links are sent by email and, if the organization uses texts, by text message from SealDrop’s number, using Amazon Web Services in Canada. Messages contain the organization’s name, the secure link, its expiry and (for texts) how to stop texts. They contain your first name only if the organization has turned that on, and nothing else about you. Reply STOP to a text to stop texts from SealDrop’s number.

Where and how long

• Everything is stored in Canada (Amazon Web Services, Montréal region), encrypted at rest and in transit.
• Uploaded files are checked for malware before the organization can open them.
• Files and form answers are deleted when the organization marks them filed, a set time after it first downloads them (72 hours by default), or 30 days after you submit if nobody downloads them — and after 35 days at the latest. Deleted files are not kept in backups.
• The rest of the request record (your name, contact details, the organization’s note and file names) is deleted 90 days after the files. The audit trail of actions (IDs and times, never your files or answers) is kept for 2 years for security, then deleted. Encrypted database backups age out 35 days after any deletion.

Who can see it

• Staff of the organization who have a SealDrop account (two-step sign-in required).
• SealDrop staff only to keep the service running, never to read files or answers in the normal course.
• Amazon Web Services hosts the service in Canada.

Your choices and rights

Ask the organization to see or correct your information. You can ignore a link; nothing is collected unless you use it. Questions or complaints about SealDrop: reach our Privacy Officer at privacy@sealdrop.ca. If you are not satisfied, you may contact the Office of the Privacy Commissioner of Canada or your provincial privacy commissioner (in British Columbia, the Office of the Information and Privacy Commissioner).

Changes

We will post changes here with a new date and tell organizations in advance.