Privacy Policy

Canopy (“Canopy,” “we,” “us,” or “our”) provides staff scheduling software for counseling, therapy and ABA practices. Canopy is operated by Fossier Studio LLC. This Privacy Policy explains what information we collect, how we use it, and the choices available to you when you use the Canopy web application and mobile apps for iOS and Android (together, the “Service”).

The Service is intended for use by the staff and administrators of the practices that subscribe to Canopy (each, an “Organization”). This policy covers personal information about those users. It does not govern how an Organization handles its own clients’ or patients’ health records, which are managed in the Organization’s own systems and under its own policies.

We collect the following categories of information:

• Account information. Your name, email address, role within your Organization, and authentication credentials needed to create and secure your account.
• Schedule, time-off, and timesheet data. Your work schedule and shifts, time-off and PTO requests and balances, and timesheet entries such as clock-in and clock-out records and worked hours.
• Messages and notifications. In-app messages you send or receive with your team, along with notifications and notices generated by the Service.
• Device & push notification tokens. When you enable push notifications on the mobile app, we store a push token (provided via Expo and delivered through Apple Push Notification service or Google Firebase Cloud Messaging) and basic device information so we can deliver notifications to your device.
• Usage & log data. Technical information generated automatically when you use the Service, such as IP address, browser or app version, device type, and timestamps of actions, used to operate, secure, and troubleshoot the Service.

We use the information described above to:

• Provide, maintain, and improve the Service;
• Authenticate users and keep accounts and Organization data secure;
• Manage schedules, time off, timesheets, and team messaging;
• Send notifications you request or that relate to your work, such as schedule changes, message alerts, and time-off updates;
• Respond to support requests and communicate with you about the Service;
• Monitor performance, detect and prevent abuse, and comply with legal obligations.

Where data protection laws such as the GDPR apply, we rely on the following legal bases: performance of our contract with your Organization to provide the Service; our legitimate interests in operating, securing, and improving the Service; compliance with legal obligations; and, where required, your consent (for example, to send push notifications). You may withdraw consent at any time without affecting prior processing.

We do not sell your personal information. We share information only as needed to operate the Service:

• Within your Organization. Schedules, time-off requests, timesheets, and messages are visible to authorized members of your Organization (for example, managers and administrators) as part of normal operation.
• Supabase.We use Supabase to host our database and manage authentication. Your data is stored and processed on Supabase’s infrastructure as our data processor.
• Apple & Google (push delivery). Push notifications are delivered through Expo and the Apple Push Notification service (APNs) and Google Firebase Cloud Messaging (FCM).
• Hosting & infrastructure providers. We rely on cloud hosting and infrastructure vendors to run the web and mobile services.
• Legal & safety. We may disclose information if required by law or to protect the rights, safety, and security of our users, the public, or Canopy.

These providers are bound to use information only to provide services to us and to protect it appropriately.

We retain personal information for as long as your account is active or as needed to provide the Service to your Organization. When an account or Organization is closed, we delete or anonymize personal information within a reasonable period, except where we must retain it to comply with legal obligations, resolve disputes, or enforce our agreements. Backups are purged on a rolling basis.

We use technical and organizational measures designed to protect personal information, including encryption in transit, access controls, and authentication safeguards. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your information and to address vulnerabilities promptly.

Depending on your location, you may have rights to access, correct, update, export, or delete your personal information, and to object to or restrict certain processing. Because your data is generally managed under your Organization’s account, please contact your Organization’s administrator first, or reach us at [email protected] and we will assist or route your request appropriately. You can manage push notifications at any time through your device settings.

The Service is intended for use by practice staff and is not directed to children. We do not knowingly collect personal information from children under the age of 13 (or the equivalent minimum age in your jurisdiction). If you believe a child has provided us with personal information, please contact us so we can delete it.

We and our service providers may process and store information in countries other than where you live. Where required, we use appropriate safeguards for international transfers. By using the Service, you understand that your information may be transferred to and processed in those locations.

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, provide additional notice. Continued use of the Service after an update means you accept the revised policy.

If you have questions about this Privacy Policy or our data practices, contact us at:

Fossier Studio LLC
[email protected]
4051 Veterans Blvd Ste 209 #105, Metairie, LA 70002