If you design for privacy, and you have no control on the remote host, you have to consider the host as being potentially compromised.
The only way then to ensure privacy, is to handle only data which is already encrypted by the client side (end to end encryption).
Of course, this limits seriously the services that could be provided by the server side ( as for the server side the data would be unintelligible. So you could also opt for a mix, encrypting sensitive data only.
SSL or TLS only protect the channel between client and host. It gives no guarantee if the host is by itself at risk.
Last but not least, it is extremely difficult to ensure host security and prevent hacking: every week there's a new story that reminds how vulnerable we are. If you use this end-to-end approach however, you protect the privacy even in case of a hack: the attacker could steal the data, but without the decryption key that would be kept on the client side, he couldn't do much.
Unfortunately, this kind of design is so safe that it would only push attackers to the next weak link: they could then try to corrupt the distributed software to get a copy of the data before it is encrypted (trojan approach)