Skip to content

Privacy Policy

Last updated: October 6, 2026

Johnson Direct Primary Care & Wellness (“we,” “us,” “our”) is a healthcare practice located at 1269 Old Euclid Center, Bristol, Virginia 24201. This Privacy Policy describes how we collect, use, and protect information from visitors to www.johnsondpc.com and visitors to our clinic. It explains your rights under the federal Health Insurance Portability and Accountability Act (HIPAA), which governs health information we handle, and describes how we follow the privacy principles of the Virginia Consumer Data Protection Act (VCDPA) as a matter of practice.

1. Two kinds of information

Protected Health Information (PHI) under HIPAA

Information that identifies you as a patient and relates to your care, including names, dates of birth, contact details, diagnoses, medications, lab results, and visit notes, is Protected Health Information (PHI) under the federal HIPAA Privacy Rule (45 CFR Parts 160 and 164). PHI is governed by our HIPAA Notice of Privacy Practices, which is available on request at the clinic.

HIPAA gives you the right to: receive a Notice of Privacy Practices, inspect and copy your medical records, request corrections, request restrictions on certain uses and disclosures, request confidential communications, and receive an accounting of disclosures. To exercise any of these rights, contact the clinic directly at (276) 494-0017 or connect@JohnsonDPC.com.

Website information (non-PHI)

Information you provide by visiting our website (for example, completing the contact form or browsing pages) is treated under this Privacy Policy, guided by Virginia’s VCDPA, separately from clinical PHI.

2. What we collect from website visitors

  • Contact form submissions: name, email, phone, and the content of your message. We ask you not to include medical details on the website form because website forms are not HIPAA-secured.
  • Analytics data: through Google Analytics 4, we receive aggregate, mostly anonymized data about pages visited, referring sources, device type, approximate location (city level), and on-site interactions like phone-link clicks.
  • Online scheduling: the appointment scheduler on our contact page is provided by Tebra, our practice-management and health-record vendor, and is loaded from Tebra’s systems. What you enter there (such as your name, date of birth, phone, and email) goes directly to Tebra and is not received or stored by this website.
  • Server logs: standard web-server logs, including IP address, user agent, and timestamps, may be retained briefly for security and abuse prevention.

3. How we use this information

  • To respond to your inquiries and schedule visits.
  • To improve the website’s content and performance.
  • To meet legal, regulatory, and security obligations.

We do not sell personal data, and we do not use website data for targeted advertising or profiling that produces legal or similarly significant effects about you.

4. Service providers we use

  • Netlify: hosts the website and processes contact-form submissions. Netlify Forms is not HIPAA-compliant and we do not have a Business Associate Agreement (BAA) in place for it. That is why the contact form is scoped to non-medical inquiries.
  • Google Analytics 4 (Google LLC): provides aggregate website analytics.
  • Google Fonts (Google LLC): serves typography on the site.
  • Tebra Technologies, Inc.: our practice-management and electronic health record (EHR) provider. It runs the online scheduler on our contact page and sends new-patient forms after we confirm a request. Tebra handles PHI subject to HIPAA’s Business Associate requirements. Information you enter in the scheduler goes to Tebra, not to this website’s host.

5. Your rights as a Virginia consumer (VCDPA)

If you are a Virginia resident, the Virginia Consumer Data Protection Act gives you the right to:

  • Confirm whether we are processing your personal data.
  • Access the personal data we have about you.
  • Correct inaccuracies in your personal data.
  • Request deletion of your personal data.
  • Obtain a portable copy of your personal data.
  • Opt out of targeted advertising, sale of personal data, and profiling that produces legal or similarly significant effects.

To exercise any of these rights, email connect@JohnsonDPC.com or call (276) 494-0017. If we deny a request, you have the right to appeal; we’ll explain that process in our response.

Note: VCDPA does not apply to information governed by HIPAA. Requests about your medical records follow the HIPAA process described above.

6. Data security

We use reasonable administrative, technical, and physical safeguards to protect personal information. PHI is handled in accordance with the HIPAA Security Rule. No method of internet transmission is 100% secure, however, so please do not include sensitive medical details in any web form, email, or text message that has not been confirmed as secure.

7. Children

Our website is not directed to children under 13, and we do not knowingly collect personal data from children online. We see patients age six and older clinically. Clinical information about minor patients is governed by HIPAA and Virginia law, not by this website policy.

8. Cookies and tracking

This site uses functional cookies (to deliver the site) and analytics cookies (Google Analytics 4). You can disable cookies in your browser settings. We do not currently respond to Do Not Track browser signals because there is no consensus standard for them, but we honor explicit VCDPA opt-out requests.

9. Changes to this policy

We may update this policy as our practices change or as the law evolves. The “Last updated” date at the top reflects the most recent revision.

10. Contact

Johnson Direct Primary Care & Wellness
1269 Old Euclid Center, Bristol, VA 24201
Phone: (276) 494-0017
Email: connect@JohnsonDPC.com