Privacy Policy

Application: CSC Contract Hours Auto-Submit

Operator: UBC Department of Urological Sciences

Effective date: 2026-05-23

1. Scope

This Privacy Policy applies to the CSC Contract Hours Auto-Submit web application ("the App"), a Google Apps Script web application used internally by the UBC Department of Urological Sciences to collect kidney-transplant surgeon contract-hours documentation.

The App is provided exclusively for use by an approved roster of UBC-affiliated surgeons and administrative staff. It is not offered to the general public.

2. Information We Collect

When you sign in with Google to use the App, we collect and process the following:

Your Google account email address, obtained via the openid and userinfo.email OAuth scopes. We use this to verify that you are on the approved submitter roster.
Files you upload, including their filenames, content, MIME types, and reported sizes.
Submission metadata, including the date and time of each upload, the canonical filename assigned to the file, and the outcome of any automated validation checks performed on the file.

We do not collect:

Your Google profile name, picture, or any non-email profile data.
Information about other files in your Google Drive.
Browser cookies beyond those Google sets for its own sign-in flow.
Analytics, tracking pixels, or third-party telemetry.

3. How We Use Your Information

Your email address is used only to:

Confirm that you are on the approved roster.
Pin each submission to your verified identity, so that uploaded files cannot be misattributed.
Record an audit-trail entry indicating which roster member submitted which file and when.

Files you upload are used only to:

Store the submission in a designated Google Drive folder belonging to the Department.
Forward the submission to the Department's contractually-designated recipients on a recurring monthly schedule.
Run automated validation and analysis appropriate to the submission's category (for example, period validation on accounting workbooks).

4. How We Store and Protect Your Information

Files and submission metadata are stored in Google Drive and Google Sheets resources owned by the Department's administrative Google account. They are not transferred to any other system.
Access to those resources is restricted to designated Department administrators.
The App runs as a Google Apps Script web application within Google's infrastructure. We do not operate independent servers or databases.
We rely on Google's own security controls for storage and transport of your data while it is held in Google Drive, Google Sheets, and the Apps Script runtime.

5. Sharing of Information

We do not sell, rent, or share your information with any third party for advertising, analytics, or any commercial purpose.

We share submitted files only as follows:

With the Department's contractually-designated recipients, as part of the recurring monthly submission cycle the App was built to support.
With Google, only to the extent that Google necessarily processes the data as the operator of Google Drive, Google Sheets, Gmail, and Apps Script.
When required by law, in response to lawful requests from public authorities.

6. Data Retention

Submitted files and their audit-trail entries are retained indefinitely to satisfy the Department's contract record-keeping obligations.

If you wish to have a specific record deleted, contact us at chris.nguan@ubcurology.com. We will honour deletion requests except where retention is required by applicable law or by an active contract obligation.

7. Your Choices

You may decline to grant the App access to your Google account at the consent screen. If you do, you will not be able to use the App.
You may revoke the App's access to your Google account at any time via https://myaccount.google.com/permissions.
You may request a copy of any submission record we hold about you, or ask us to correct an inaccuracy in that record, by contacting chris.nguan@ubcurology.com.

8. Limited Use of Google User Data

The App's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, the App:

Uses Google user data (your email address and files you choose to upload) only to provide and improve the App's submission-handling features described above.
Does not transfer Google user data to third parties except as strictly necessary to provide or improve those features, to comply with applicable law, or as part of a merger, acquisition, or sale of assets with appropriate notice to users.
Does not use Google user data for serving advertisements.
Does not allow humans to read Google user data unless we have your affirmative consent for specific files, doing so is necessary for security purposes (for example, investigating abuse), or doing so is required by applicable law.

9. Children

The App is not directed to and is not intended for use by anyone under the age of 18. We do not knowingly collect information from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated to roster members at their registered Google account email address before they take effect. The "Effective date" at the top of this document indicates when the current version took effect.

11. Contact

Questions about this Privacy Policy, or requests to access, correct, or delete your data, may be directed to:

Chris Nguan
UBC Department of Urological Sciences
chris.nguan@ubcurology.com