Privacy Policy and Terms of Use

1. Notice of Privacy Practices (HIPAA + 42 CFR Part 2)

If you are a patient or prospective patient, please review our separate Notice of Privacy Practices for information about your medical records and privacy rights.

Substance Use Disorder (SUD) Records — 42 CFR Part 2

If we create or maintain records relating to Substance Use Disorder (SUD) diagnosis, treatment, or referral, those records receive additional federal protections under 42 CFR Part 2 and related law, as updated effective February 16, 2026. Where applicable:

• SUD records may require your specific written consent for certain uses or disclosures.
• SUD records have heightened restrictions on redisclosure to third parties.
• SUD records may not be used for fundraising purposes except as expressly permitted by law.
• You may have additional rights regarding access, accounting of disclosures, and revocation of consent.

Please review our current Notice of Privacy Practices (Updated February 2026) for complete details.

2. Information We Collect Through This Website

We may collect the following categories of information:

Information You Provide Voluntarily

• Name
• Email address
• Phone number
• Preferred appointment times
• Insurance or administrative details you choose to provide
• Messages submitted through secure forms

Information Collected Automatically

• IP address
• Browser type and version
• Device type
• Pages visited and time spent
• Referral source
• General geographic region
• Website usage analytics

3. What We Use Information For

We may use collected information to:

• Respond to inquiries and schedule appointments
• Provide patient support and follow-up communications
• Improve website performance and accessibility
• Maintain security and prevent fraud
• Comply with legal and regulatory obligations
• Communicate operational updates

4. Protected Health Information (PHI)

Medical information submitted through approved secure systems is handled in accordance with HIPAA, applicable state law, and where relevant, 42 CFR Part 2. Our secure patient portal is available at dmbhintouch.insynchcs.com.

5. Secure Forms and Communications

When you use our designated intake or contact forms marked as secure:

• Data is encrypted in transit using TLS 1.2 minimum / TLS 1.3 preferred (current industry standard).
• Access is restricted to authorized personnel and approved service providers.
• We maintain Business Associate Agreements (BAAs) with all vendors who handle protected information, as required by HIPAA.

6. SMS / Text Messaging Disclosures

If you choose to contact us by text message:

• Message and data rates may apply.
• Message frequency may vary.
• You may opt out at any time by replying STOP or by contacting our office directly.
• Standard text messaging is not encrypted and may not be secure. By texting us, you acknowledge the privacy risks of unencrypted communication.

7. Cookies and Analytics

We may use cookies, server logs, and analytics tools (such as Google Analytics) to understand site usage and improve performance. This information is aggregated and does not personally identify you.

You may disable cookies in your browser settings, though some site features may not function properly if you do so. We do not use spyware, adware, or other intrusive tracking software.

8. Sharing Information

We may share information only as necessary and permitted by law with:

• Authorized workforce members at Dragonfly Medical and Behavioral Health
• HIPAA-compliant vendors and service providers under Business Associate Agreements
• Scheduling or communications platforms under contract
• Regulators or law enforcement when legally required
• Others only with your explicit authorization or consent

9. Data Security

We use administrative, technical, and physical safeguards designed to protect your information, including:

• Encryption in transit (TLS 1.2 minimum / TLS 1.3 preferred)
• Role-based access controls limiting access to authorized staff
• Secure, HIPAA-compliant hosting environments
• Routine security monitoring and auditing
• Data backup and recovery procedures

10. Accessibility Statement

Dragonfly Medical and Behavioral Health is committed to digital accessibility for all users, including individuals with disabilities, in compliance with the HHS accessibility rule effective May 11, 2026.

WCAG 2.1 Level AA

We strive to conform to Web Content Accessibility Guidelines (WCAG) 2.1 Level AA standards and continuously improve the usability of our website for assistive technologies.

If you experience any difficulty accessing any page, form, portal, or document on our website — including our Notice of Privacy Practices or Patient Portal — please contact us:

• Phone: 423-588-9978
• In person: 102 North Broadway Street, Johnson City, TN 37601

For our full accessibility statement, please visit dragonflymedicalandbehavioralhealth.com/accessibility-statement.html.

11. Your Privacy Rights

Depending on applicable federal and state law, you may have rights to:

• Request access to certain personal information we hold about you
• Request corrections to inaccurate information
• Request restrictions on certain uses or disclosures where permitted by law
• Withdraw consent where applicable
• Receive and update your communications preferences
• File a privacy complaint without retaliation

Patient rights regarding Protected Health Information (PHI) are described more fully in our Notice of Privacy Practices.

12. Third-Party Links

Our website may link to third-party websites or patient portals (including InSync, Cognito Forms, and social media platforms). We are not responsible for the privacy practices or content of third-party sites. We encourage you to review the privacy policies of any site you visit.

13. Children's Privacy

Our website is not intended to collect personal information directly from children under the age of 13 without appropriate parental or guardian consent. If you believe a child has submitted information without consent, please contact our office immediately.

14. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in law, our practices, or our services. Revisions will be posted on this page with an updated effective date. We encourage you to review this page periodically for the most current information.

15. Contact Us

For privacy requests, accessibility assistance, or to exercise your rights, please contact our office using any of the methods below.