PRIVACY POLICY
329Design Inc. (SimpleSet)
At 329Design Inc. (“329Design”, “we”, “us”), we understand the responsibility that comes along with providing a healthcare management technology and the importance of privacy protections. This Privacy Policy helps explain the privacy features of our content, products or services listed on simpleset.net (the “Website”), through our applications (the “Apps”), Software or via other delivery methods to you (the Website, Apps, Software and such content, products, services and features are collectively referred to herein as the “Product” or “Products”, which may be updated from time-to-time at the sole discretion of 329Design). The Privacy Policy describes how we help healthcare professionals manage and protect the privacy of Personal Data through the Products and describes how we collect, use, disclose and protect Personal Data when you interact or use our Products.
329Design has international customers and, as such, must comply with different legislations around the globe through a continuous process of privacy review. All Personal Data is treated with the highest level of security to comply with Data Protection Laws.
We are a Canadian company and comply with the overarching Canadian privacy law, PIPEDA. In some instances, provincial privacy and health-information legislation also applies — for example, the Health Information Act (Alberta) (the “HIA”) applies where our Customer is a “custodian” in Alberta (which now includes physiotherapists). We comply in these instances. See “Health Information — Alberta Custodians (HIA)” below.
DEFINITIONS
The following terms shall have the definitions contained below.
329Design Inc.: The corporation name under which the Software has been developed.
Software: a web-based software by the name SimpleSet as developed by 329Design.
Customer: An individual or organization with a trial, student or paid subscription account to one of 329Design’s solutions.
Client-User: The recipient of an exercise program, educational material or outcome measure created by a Customer.
Controller: The natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of Processing of Personal Data.
Custodian: A person or organization that is a “custodian” as defined in the HIA, including a physiotherapist regulated by the College of Physiotherapists of Alberta and any other regulated health professional designated as a custodian under the HIA.
Data Protection Laws: means all laws and regulations applicable to the Processing of Customer Personal Data, including, as applicable: (i) the Personal Information Protection and Electronic Documents Act (Canada) (“PIPEDA”); (ii) the Health Information Act (Alberta) (“HIA”) and other applicable Canadian provincial health-information and privacy legislation; (iii) the California Consumer Privacy Act, as amended by the California Privacy Rights Act, and any binding regulations promulgated thereunder (“CCPA”); (iv) the General Data Protection Regulation (Regulation (EU) 2016/679) (“EU GDPR” or “GDPR”); (v) the Swiss Federal Act on Data Protection (“FADP”); and (vi) the EU GDPR as it forms part of the law of England and Wales by virtue of section 3 of the European Union (Withdrawal) Act 2018 (the “UK GDPR”) and the UK Data Protection Act 2018; in each case, as updated, amended or replaced from time to time.
Information Management Agreement (“IMA”): The standard-form information management agreement entered into between 329Design and a Custodian under section 66 of the HIA. A copy is available from support@simpleset.net.
Information Manager: An information manager under section 66 of the HIA — a person or body that processes, stores, retrieves or disposes of health information on behalf of a Custodian.
Personal Data: Information about an identified or identifiable natural person or which otherwise constitutes “personal data”, “personal information”, “personally identifiable information”, “health information” or similar terms as defined in Data Protection Laws.
Processor: A natural or legal person, public authority, agency or other body which Processes Personal Data on behalf of the Controller.
Processing: And inflections thereof refer to any operation or set of operations that is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
HEALTH INFORMATION — ALBERTA CUSTODIANS (HIA)
Where a Customer is a Custodian under the HIA, 329Design acts as that Customer’s Information Manager, and is designated as the Customer’s affiliate, under section 66 of the HIA pursuant to the IMA entered into between 329Design and the Customer.
For health information that is subject to the HIA:
• the IMA governs the collection, use, disclosure, storage, retention, return and destruction of that health information, and prevails over this Privacy Policy and any Data Processing Addendum (“DPA”) to the extent of any conflict;
• references in this Privacy Policy to “Controller” and “Processor” should be read as references to the “Custodian” and the “Information Manager”, respectively;
• the Custodian remains responsible for compliance with the HIA in respect of the health information, and 329Design does not become a custodian by holding or processing it; and
• 329Design never uses health information for its own purposes, including marketing or advertising (see “Marketing” below).
Alberta Custodians remain responsible for their own obligations under the HIA, including conducting and submitting privacy impact assessments to the Office of the Information and Privacy Commissioner of Alberta where required before implementing new information systems.
LEGAL BASIS
The legal basis for data collected is founded in consent as well as the legitimate use of Personal Data for the operation of 329Design’s Products. For health information subject to the HIA, 329Design processes that information under the authority of the Custodian and the IMA. We operate with the general principle of Personal Data collection on an “as necessary” basis. Personal Data collected may be used for day to day operations necessary to provide the Products, understanding and improving our services, direct marketing relating to our services (Customers only — we never use Client-User Data for marketing; see “Marketing” below), communicating with our Customers and Client-Users, and protecting our legal rights and interests. At no time do our Personal Data collection practices override your fundamental rights and freedoms.
CONSENT
When Customers agree to our Terms of Service (“TOS”) and provide us with Personal Data, we assume the Customer consents to our collecting Personal Data and usage as outlined in this Privacy Policy.
329Design collects Personal Data of Client-Users under the direction of its Customers as detailed in this Privacy Policy. Such Personal Data is voluntary, and not a requirement for the operation of our Products, and is at the discretion of the Customer. 329Design has no direct relationship with Client-Users whose Personal Data may be collected. It is the responsibility of the Customer to ensure they obtain consent and legal right for the use of all Personal Data. Customers are responsible for complying with laws and regulations governing the use of Client-User Data. Should Customers decide to provide Personal Data regarding Client-Users, as outlined in this Privacy Policy, 329Design assumes that consent has been obtained from the Client-User (or from parent or legal guardian if the Client-User is a minor) by the Customer. Where the Customer is an Alberta Custodian, the Customer’s collection, use and disclosure of Client-User health information is governed by the authority-based framework of the HIA, and the Customer is responsible for ensuring that its use of the Products complies with the HIA.
If you are a Client-User, we act as the Processor of your Personal Data on behalf of our Customer (typically your healthcare practitioner providing services as a regulated healthcare practitioner) — or, where your healthcare practitioner is an Alberta Custodian, as their Information Manager under the HIA. The Customer is considered the Controller (or Custodian) of your Personal Data. Client-User Data will be governed by the Customer’s practices, policies, and obligations pertaining to the: collection; use; access; length of storage and; where applicable, deletion of Client-User Data.
If you have questions regarding our Customer’s legal basis and consent for collection and use of your Personal Data, please contact your healthcare practitioner directly. Please refer below to “Information collected for our Customers” for more information on how Personal Data is processed by 329Design.
329Design stores Client-User Data in its secure Personal Data centers and provides availability of such Personal Data to its Customers through its Products. 329Design has no control over the collection of this Personal Data and is considered a Processor (or, for Alberta Custodians, an Information Manager). 329Design will only access Client-User Data under the direction of the Customer(s), to rectify technical problems, or if required by law.
Individuals can withdraw consent at any time by contacting us.
PERSONAL INFORMATION COLLECTED
Information Automatically Collected
Some Personal Data is automatically collected when anyone visits our website, as is typical for most websites, including User-Agent and IP address as well as what pages you visit on our website.
Some Personal Data is automatically collected when the Customer and Client-User uses our Products, including the following: Device information (only if using the App version), Log in date, Usage information, and User agent. Please see Appendix A regarding a breakdown of what Personal Data is collected, a description of why it is collected, and any third party processors.
Cookie Policy
If you have cookies enabled and use our Website, we send one or more “cookies” to your computer or other devices. Cookies are alphanumeric identifiers stored on your computer through your web browser and are used by most websites to help personalize your web experience. Some cookies may facilitate additional site features for enhanced performance and functionality such as remembering preferences, analyzing usage for site optimization, and providing custom content.
We use both session cookies and persistent cookies. A session cookie expires when you logout of SimpleSet. A persistent cookie remains on your computer for an extended period of time. Currently we use persistent cookies to optimize and enhance the experience on our site and reach potential customers. Cookies used for marketing purposes are used only on our public website and in relation to Customers and prospective Customers — never in relation to Client-User Data.
Visitors can remove persistent and session cookies or reject them on our website by following directions provided in your Internet browser’s “help” file. To learn more about cookies and how to manage them, please visit: https://www.cookiesandyou.com/.
Information Collected Regarding our Customers
We collect Personal Data about our Customers when they choose to provide such information directly to us with their consent. In most cases 329Design is the Controller of such Personal Data. See Appendix A for a list of Customer Data and purposes for collection necessary to provide our service.
Information Collected for our Customers
As detailed above, 329Design collects information of Client-Users under the direction of its Customers for the purposes of exercise prescription. This includes, but is not limited to, information such as names, email address, birth year, exercise program(s) of Client-Users, as well as any other information Customers decide to enter (Text Data, Image Data, Video File Data). A detailed list of such data is provided in Appendix A. Where the Customer is an Alberta Custodian, this information constitutes “health information” under the HIA and is governed by the IMA.
Rights
Individuals have certain rights with respect to their Personal Data. These rights are outlined below.
Customers can exercise their rights by contacting 329Design directly.
Note for Patients (Client-Users): 329Design acts as a processor (or, for Alberta Custodians, an information manager under the HIA) on behalf of your Healthcare Provider. 329Design does not have a direct relationship with patients. To exercise your rights regarding your health records — including, for Alberta patients, access and correction rights under Part 2 of the HIA — please contact your Healthcare Provider directly. 329Design will assist your provider in fulfilling these requests as required by our contractual agreements, including within the 30-day response period that applies to your provider under the HIA.
Access: you are entitled to access your Personal Data. Upon request, 329Design will inform individuals of the existence, use and disclosure of his or her personal information. 329Design will give access to that information, including a listing of the third-party organizations with whom the information has been shared. This listing can be found in the Appendix A of this Privacy Policy.
Rectification: upon request, with limited exceptions, 329Design will correct or make note of any inaccurate Personal Data concerning you and have incomplete Personal Data completed. Notification will be made to appropriate parties on rectification of Personal Data.
Erasure “Right to be Forgotten”: Customers and Client-Users have the right to request, and if applicable and appropriate, 329Design to permanently delete your Personal Data. Our Personal Data retention is detailed in this Privacy Policy under Data Retention. Health information subject to an IMA is deleted only in accordance with the IMA and the Custodian’s record-retention obligations. Notification will be made to appropriate parties on erasure of Personal Data.
Data Portability: Customers and Client-Users have the right to receive the Personal Data concerning him or her, which he or she has provided to 329Design, and have the right to transmit this Personal Data to another organization. Personal Data can be exported in PDF format by the user at any time.
Right to Restriction: You may request that we “pause” the processing of your data (e.g., while you contest its accuracy).
Right to Object: You have the right to object to processing based on our legitimate interests or for direct marketing.
Objection and Restriction: Under certain circumstances, Customers or Client-Users are entitled to object to, and restrict the use of, Personal Data.
Withdraw consent: Customers and Client-Users have the right to withdraw consent to use of their Personal Data at any time. 329Design will communicate the implications of this withdrawal of consent should this be requested.
Complaints: Customers or Client-Users have the right to lodge a complaint with a supervisory authority. The Office of the Information and Privacy Commissioner of Saskatchewan is: https://oipc.sk.ca/. The Office of the Information and Privacy Commissioner of Alberta is: https://oipc.ab.ca/. The Office of the Privacy Commissioner of Canada is: http://www.priv.gc.ca/.
Complaints from Customers in the EU and UK: Customers in the EU and UK may also make enquiries through our representatives:
• Representative in the EU — Email: simpleset@willansdps.com; Post: Willans Data Protection Limited, 2 Pembroke House, 28-32 Upper Pembroke Street, Dublin, Ireland D02 EK84; Phone (in Ireland): 00 353 1 447 0402.
• Representative in the UK — Email: simpleset@willansdps.com; Post: Willans Data Protection Limited, 34 Imperial Square, Cheltenham, Gloucestershire GL50 1QZ, United Kingdom; Phone (in the United Kingdom): +44 (0)1242 514 000.
Use of Information Collected
329Design will never sell or rent personal information to a third party. We will not use or share your information other than as described in this Privacy Policy unless it is under written direction from the individual or organization.
329Design will only use personal information to operate, improve and understand our services. We may use personal information to: provide support and assistance for the services; communicate with you about the services; respond to Customer and Client-User inquiries; create and manage Customer and Client-User profiles; fulfill Customer and Client-User requests; resolve disputes; contact Customers about service announcements, updates and our offers; complete a sale/transaction; process orders.
329Design shares information with third party service providers and agents who work on our behalf and provide us with services related to the purposes described in this Privacy Policy and our TOS. These third party service providers will have limited access to Customer’s Data, but only so much to do their job. A list of uses of Personal Data and third party service providers is detailed below in appendices A and B.
Marketing
We may send Customers and prospective Customers service announcements and marketing relating to our own services, and we use tools such as Google Ads, Google Tag Manager and our CRM only for that purpose. We never use Client-User Data — including a patient’s name or email address — for marketing or advertising of any kind, and Client-User Data is never shared with, or processed by, our marketing, advertising or CRM tools. Health information of patients of Alberta Custodians is never used for marketing.
ADDITIONAL INFORMATION
Legal
There are some instances where it may be necessary to disclose information collected. 329Design reserves the right to disclose information to comply with our legal obligations and applicable laws; protect against, deter, investigate fraudulent, illegal or harmful actions; resolve disputes; protect our rights. Where permitted by law, we will notify the affected Customer before disclosing Personal Data in response to a demand from a court, government or law-enforcement authority. For health information subject to an IMA, the IMA’s provisions respecting third-party and foreign demands apply.
Data Retention
Customer Data. 329Design will retain your Personal Data as part of the service provided as long as you are a Customer of 329Design. A Customer ceases to be a Customer on the date of expiry of their account and/or last paid invoice. Customer Data will be securely removed from 329Design servers 12 months after this date. Customers will be able to export their Personal Data during this time. Customers can request 329Design to continue to store their Personal Data at their specified subscription cost.
Client-User Data. Client-User Data is retained, returned and deleted under the direction of the Customer. Customers are responsible for complying with the health-record retention laws, regulations and professional standards of their jurisdiction — for example, Alberta physiotherapists are currently required to retain patient records for at least 10 years following the last date of service (longer for minors). Before any deletion, Client-User Data remains available for export by the Customer for at least 12 months following the end of the Customer’s account. Where the Customer is an Alberta Custodian, Client-User health information is returned or destroyed only in accordance with the IMA — including return in a usable electronic format on request, destruction only on the Custodian’s written direction, and provision of a certificate of destruction.
329Design may retain your Personal Data to the extent necessary to comply with our legal obligations.
Customers can update their information, terminate their account or remove their personal information at any time by contacting us.
Location of Data
All Customer and Client-User Data is stored in Canada. Production data is stored in the Amazon Web Services (AWS) Canada (Central) region located in Montréal, Québec. Backup data is stored in the AWS Canada West region located in Calgary, Alberta. Data is encrypted in transit and at rest.
For Alberta Custodians: because production data is stored in Canada but outside Alberta, the IMA contains the protections required by section 8(4) of the Health Information Regulation (Alberta) for health information stored, used or disclosed outside Alberta, including Custodian control, risk mitigation, safeguards, monitoring rights and remedies.
Security
329Design views the security of all personal information as a priority. We use appropriate safeguards to keep your Personal Data private and confidential. We have implemented administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the Personal Data that we create, receive, maintain, or transmit on behalf of a Customer, consistent with the standards required by applicable Data Protection Laws (including section 60 of the HIA and section 8 of the Health Information Regulation (Alberta) for health information of Alberta Custodians). Such safeguards include:
• Maintaining appropriate clearance procedures and providing supervision to assure that our workforce follows appropriate security procedures;
• Providing appropriate training for our staff to assure that our staff complies with our security policies;
• Making use of appropriate encryption when transmitting Personal Data over the Internet and when storing Personal Data at rest;
• Utilizing appropriate storage, backup, disposal, and reuse procedures to protect Personal Data;
• Utilizing appropriate authentication and access controls (including role-based access and audit logging) to safeguard Personal Data; and
• Utilizing appropriate security incident procedures and providing training to our staff sufficient to detect and analyze security incidents.
However, no computer system, method of transmission, or method of electronic storage can ever be fully protected from every possible threat. Therefore, while 329Design takes measures to ensure the security of online transmission and storage of all Personal Data to the best standards and practices of the industry, we cannot guarantee its absolute security. We will notify affected Customers without unreasonable delay if a breach occurs that may have compromised the security of your information. Where the Customer is an Alberta Custodian, breach notification, containment, remediation and assistance with the Custodian’s reporting duties are governed by the IMA.
Modifications to This Privacy Policy
We regularly review and update our Privacy Policy. As such, this Privacy Policy may be amended or modified by 329Design at any time and without prior notice, except that changes affecting health information subject to an IMA will be made in accordance with the IMA. This Privacy Policy was last updated and goes into effect on September 16, 2026.
CONTACT US
329Design Inc. has appointed a Privacy Officer who is responsible for overseeing our privacy compliance program and responding to inquiries regarding our data practices. If you have questions about this Privacy Policy, wish to exercise your rights, or have a complaint regarding our compliance with PIPEDA, the HIA, or the GDPR, please contact:
Attn: Privacy Officer
Email: support@simpleset.net
Phone: 1-844-321-2823
Postal mail: 329Design Inc., 1 – 2217 Hanselman Court, Saskatoon, SK S7L 6A8
APPENDIX A — INFORMATION COLLECTED
Customer Data
Field Name | Description | 3rd Party Processors |
First & Last Name | Needed to create an account | Pipedrive, Chargebee |
Username | Chargebee | |
Email Address | Pipedrive, Chargebee | |
Company Name | As needed if services are purchased | Pipedrive, Chargebee |
Phone Number | ||
Fax Number | ||
Address | ||
Billing Address | Pipedrive, Chargebee | |
Billing Information | Chargebee, Worldline | |
Password | Non-reversibly encrypted | AWS |
User-Agent & IP address | Website statistics | Cloudflare, Google Analytics, AWS |
Usage Information | Date account was created; number of logins; login date; number of exercise programs; number of times exercises, images and videos are viewed; number of prints; number of times client accesses program; date and time exercise program is sent; search phrases | AWS |
Custom Exercise Images | Image(s) the Customer chooses to upload | AWS |
Custom Exercise Videos | Video(s) the Customer chooses to upload | AWS |
File Uploads (ie .pdf, .docx, etc) | File(s) the Customer chooses to upload | AWS |
Client-User Data
All information collected regarding Client-Users is optional and is under the direction and discretion of the Customer. Inclusion of Client-User Data by the Customer is not a requirement for the operation of the SimpleSet Application. Where the Customer is an Alberta Custodian, Client-User Data constitutes “health information” under the HIA and is governed by the IMA.
Field Name | Description | 3rd Party Processors |
User-Agent & IP Address | Website statistics; web push | AWS, Endpoints* |
First & Last Name | Can be de-identified. | AWS |
Email Address | Optional. | |
Client-User Portal Key | Used for additional security to confirm identity during login to Client-User portal to access exercise program(s). | |
Client Portal Username | Chosen by the Client-User for login to client portal to access exercise program(s) | |
Language | Language preferred by the Client-User | |
Exercise Program(s) | Exercise programs or “Sets” created by the Customer for use of the Client-User. Typically this includes exercise: stock and/or custom images, stock and/or custom videos, instructions/educational content, and parameters. May also include any additional text the Customer chooses to include as part of the exercise program. | |
Text Data | Any text data the Customer chooses to include as part of an exercise program | |
Custom Image and/or Video Data | Image(s) or video(s) the Customer chooses to upload of the Client-User. | |
Client Notes | Free text notes, exercise progress (ie sets and repetitions, weight and time), emoji scale of rate of perceived challenge of an exercise | |
Real Time Chat | Real time text communication between therapist and their client | |
Client Feedback | Client-Users can enter how they feel on a visual emoji scale | |
Outcome Measures | Any outcome measures the Customer chooses to assign and have completed by the Client-User | |
File Data | Files the Customer chooses to upload. | |
Password | Stored as a salted hash | |
Usage Information | Number of exercise program(s); login date & time; number of prints; number of times exercise program(s) are accessed. |
* See Web Push Notification Section in Appendix B for complete list of web push endpoints
APPENDIX B — THIRD PARTY VENDORS
Third Party Vendors for 329Design do not process unencrypted electronic personal health information. Electronic health information is only processed to the extent that AWS stores and transmits encrypted data as outlined below.
Subprocessor Notification. To stay updated on changes to our service providers, you may subscribe to our Subprocessor Notification List. In accordance with our Data Processing Agreement and, for Alberta Custodians, the IMA, we will provide at least 30 days’ notice via this list before authorized changes take effect.
Third-Party Name | Usage | Country | DPA | Processes Client-User Data? |
Amazon Web Services Canada (AWS) | AWS is responsible for the operation, management, and control of the components from the host operating system and virtualization as well as physical security of the physical infrastructure including: servers, network, and data center. 329Design owns and controls access to this infrastructure as well as encrypted data stored on this infrastructure. All Customer and Client-User Data is hosted in AWS Canadian regions (production: Montréal, Québec; backups: Calgary, Alberta). | Data hosted in Canada | Yes | Yes — encrypted hosting and backups only |
Workspace: 329Design uses Google Workspace to host our email. All @simpleset.ca & @simpleset.net emails are handled by Google Workspace. Cloud: We use Google Cloud for integration of SSO for Customers who utilize their own Google Accounts as an IDP for authentication — no actual Customer or Client-User Data is stored in Google Cloud. Analytics: Google Analytics is used on our website to track customary information, such as screen resolution, browser, etc. Analytics is used in the application to help us understand how the application is used to assist in development. No identifying information is processed by Analytics. Ads: We use Google Ads to market our product to Customers and prospective Customers only. We do not use ads to market other products to you. Tag Manager: We use Google Tag Manager to communicate with Google Ads for retargeting of advertising material to market our product. No identifying Customer or Client-User electronic personal health information is processed by Google Ads or Tag Manager. | United States | Yes | Only if included in email correspondence initiated by a Customer | |
Microsoft | Azure — utilized for IDP integrations for Customers with Microsoft emails for SSO. Teams — used for sales video calls in conjunction with Calendly. Microsoft Azure and Teams are not utilized for storage of Customer or Client-User Data. | Canada | Yes | No |
Worldline | 329Design uses Worldline for processing payments. | Canada | Yes | No |
Chargebee | Chargebee is a subscription management platform. 329Design uses Chargebee to manage Customer accounts and invoices for 329Design services. Customer information shared with Chargebee is detailed in Appendix A. No Client-User Data is shared with Chargebee. | United States | Yes | No |
Cloudflare | 329Design uses Cloudflare for DNS and content distribution. | United States | Yes | No |
Tremendous | Used for distributing gift cards in our user referral program. | United States | Yes | No |
HelpScout | 329Design uses HelpScout to help manage customer service requests sent through email. A beacon is used within the application for access to our knowledge base, live chat or email and for announcements. | United States | Yes | Only if included in a support request by a Customer |
Pipedrive | Pipedrive is our CRM for management of accounts through the sales process. | United States | Yes | No |
Calendly | Used for booking sales or support calls. | United States | Yes | No |
CloudTalk | VOIP provider for customer support. | Canada | Yes | No |
Sentry | Sentry is utilized for error tracking. Client-User data is scrubbed prior to being processed by Sentry. | Germany | Yes | No — scrubbed |
UserGuiding | UserGuiding is used for user onboarding tutorials. UserGuiding does not process Client-User Data. | Germany | Yes | No |
CookieFirst | CookieFirst is an EU-based, cloud-hosted Consent Management Platform (CMP) that helps websites comply with international privacy laws like the GDPR. | Holland | Yes | Yes — No identifiable information |
Web Push Notifications
329Design’s SimpleSet application utilizes web push notifications when updates are made to exercise programs by a Customer. No personal identifying information is shared, nor specific information about the changes made to the exercise program. The data pushed is: IP address and User-Agent, that there has been an update to the exercise program, with a redirect link back to the SimpleSet application Client-User portal login webpage.
Endpoints that are used for Web Push Notifications:
• android.googleapis.com
• fcm.googleapis.com
• updates.push.services.mozilla.com
• updates-autopush.stage.mozaws.net
• updates-autopush.dev.mozaws.net
• *.notify.windows.com
• *.push.apple.com