Does Movently make me compliant with Law 25?

No, and be wary of software that promises it. Compliance is about your practices: access within your team, your retention periods, how you respond to an incident. Movently gives you the documents published under your name, timestamped consent, a cookie refusal that works, and the list of our suppliers. The rest is yours.

Is my data hosted in Quebec?

No. It is hosted and processed mostly in the United States, and every supplier is named with its country in our privacy policy. The law does not forbid this; it requires a prior assessment, which we publish at section 7 of that same policy. We would rather give you the exact list than an assurance we could not keep.

Do I need to name a privacy officer even if I work alone?

The role exists either way. Absent an explicit designation, the law assigns it to the person exercising the highest authority in the business, which in a one-person studio is you. What changes is that the name and a way to reach that person have to be published.

Is the privacy policy you provide ready to publish as-is?

It is a starting point, not a vetted document. It was written for a Quebec movement studio — Law 25, Stripe, GST-QST — and it is fully editable from your admin precisely because it has to describe your studio rather than a generic one. Have it reviewed.

Law 25

Law 25, and what it asks of your studio.

If you collect your clients’ names, emails and sometimes their health information, you are the business the law is about — not your software. Here is what it expects of you, what Movently puts in place on its side, and where your data lives.

You are the business

Law 25 applies to businesses that collect personal information in Quebec, and a studio keeping a client list is one. Your booking platform is a supplier: it has its own obligations toward you, and they do not replace yours toward your clients.

That distinction has a practical consequence. No software can make you compliant, because most of what the law asks about is your practices: who on your team sees what, how long you keep a record, what you do the day something leaks. What software can do is give you the documents, the consent and the answers — so the rest is work you can actually do.

What the law asks for, in practice

The list below is not the text of the law. It is what comes up concretely for a studio the size of the ones we serve.

A published privacy policy, in French, saying what you collect and why.
A named, reachable person responsible for the protection of personal information. Absent an explicit designation, the law gives the role to the person with the highest authority — in a studio, the owner.
Consent, asked for clearly and separately for anything not necessary to delivering the service.
Separate consent for analytics cookies, and a refusal that actually works.
The ability to answer a request for access, correction or withdrawal.
Reporting confidentiality incidents that present a risk of serious injury.
Knowing where information goes when it leaves Quebec, and having assessed that before sending it.

What Movently provides

Each of these is built and running today. None of them makes you compliant on its own — they are the part a piece of software can carry.

Your own terms of use and privacy policy, editable from your admin and published on your booking site, under your name.
A consent checkbox at signup that records which version of the document was accepted, and when.
A cookie banner on your booking site that can be refused, where nothing is measured until consent is given — declining is a real decline, not a delay.
The app and the site in French, including the emails sent to your clients.
The named list of our own suppliers, with their countries, so you can answer when a client asks you where her data is.

Where your data is

In the United States, mostly. Movently is a Quebec business, the app is French-first, and the hosting is American: the database and authentication at Google (Firebase), application hosting at Render, email at Resend, video at Cloudflare, analytics at PostHog and error reporting at Sentry. Stripe processes payments in Ireland and the United States.

Law 25 does not forbid holding information outside Quebec. It requires that, before entrusting it, you have assessed whether it will receive adequate protection there — given its sensitivity, the intended use, the supplier’s contractual and technical protections, and the legal framework where it is held. That assessment is published in our privacy policy at section 7, and every supplier is named with its country at section 6.

We put this here rather than in a footnote for a practical reason: it is the question your clients will put to you, and you are the one who has to answer it. A named list is what lets you.

This is not legal advice

This page describes what the law asks for and what the product does. It does not tell you what to do, and it is not a substitute for professional advice. The documents Movently provides are a starting point written for a Quebec studio, not a vetted template for yours — have them reviewed before relying on them.

What we get asked

Does Movently make me compliant with Law 25?: No, and be wary of software that promises it. Compliance is about your practices: access within your team, your retention periods, how you respond to an incident. Movently gives you the documents published under your name, timestamped consent, a cookie refusal that works, and the list of our suppliers. The rest is yours.
Is my data hosted in Quebec?: No. It is hosted and processed mostly in the United States, and every supplier is named with its country in our privacy policy. The law does not forbid this; it requires a prior assessment, which we publish at section 7 of that same policy. We would rather give you the exact list than an assurance we could not keep.
Do I need to name a privacy officer even if I work alone?: The role exists either way. Absent an explicit designation, the law assigns it to the person exercising the highest authority in the business, which in a one-person studio is you. What changes is that the name and a way to reach that person have to be published.
Is the privacy policy you provide ready to publish as-is?: It is a starting point, not a vetted document. It was written for a Quebec movement studio — Law 25, Stripe, GST-QST — and it is fully editable from your admin precisely because it has to describe your studio rather than a generic one. Have it reviewed.

Studio software made in Quebec

French-first, with the documents and the consent already in place. Movently opens to studios in small groups — leave your email.

Join the list