Privacy Policy
PRIVACY POLICY
Effective Date: May 1, 2026
1. Introduction
Magnolia Law, P.C. ("Magnolia Law," "we," "us," or "our") is committed to protecting the privacy of visitors to our website located at www.magnolialawva.com (the "Site") and individuals with whom we interact in connection with our services. This Privacy Policy is designed to comply with the Virginia Consumer Data Protection Act ("VCDPA"), Va. Code § 59.1-575 et seq., and other applicable federal and state law. This policy applies to personal data collected through the Site and related business operations; it does not govern information subject to attorney-client privilege, which is protected separately under the Virginia Rules of Professional Conduct.law.
2. Categories of Personal Data We Collect
We collect the following categories of personal data: (a) identifiers, such as name, mailing address, email address, and phone number; (b) case- and matter-related information you submit through intake forms, contact forms, or email; (c) commercial information, such as billing and payment details; (d) internet activity information, including IP address, browser type, device identifiers, and Site usage data collected via cookies and similar technologies; and (e) sensitive data, where applicable, such as health-related information disclosed in connection with family law, estate planning, or other matters.
3. Purpose of Processing
We process personal data to: respond to inquiries and intake requests; evaluate and provide legal services; communicate with clients, prospective clients, and third parties involved in a matter; process payments; comply with legal, ethical, and regulatory obligations; and maintain and improve the Site. We do not sell personal data, and we do not process personal data for targeted advertising.
4. Sensitive Data and Consent
Where our intake or representation process requires collection of sensitive data — including health diagnoses, precise geolocation, racial or ethnic origin, or similar categories defined under the VCDPA — we will not process such data without your prior, freely given, specific, informed, and unambiguous consent, except where processing is necessary to provide services you have requested or as otherwise permitted by law. Personal data protected as protected health information ("PHI") under HIPAA is separately addressed in Section 8 below and is exempt from certain VCDPA provisions.
5. Categories of Third Parties and Data Sharing
We may share personal data with: (a) service providers who support Site hosting, case management, billing, or communications, under confidentiality obligations; (b) co-counsel, experts, courts, opposing counsel, or other parties as necessary to represent your interests; (c) government agencies or regulators as required by law; and (d) a successor entity in the event of a merger, acquisition, or sale of firm assets. We do not sell personal data to third parties or share it for cross-context behavioral advertising.
6. Your Rights Under the VCDPA
If you are a Virginia resident, you have the right to: (1) confirm whether we are processing your personal data and access that data; (2) correct inaccuracies in your personal data; (3) request deletion of personal data we hold about you; (4) obtain a portable copy of personal data you previously provided to us; and (5) opt out of processing your personal data for targeted advertising, sale, or certain profiling. These rights do not apply to information maintained in connection with attorney-client representation or as otherwise exempted under Va. Code § 59.1-576.
To exercise these rights, submit a request using the contact information in Section 12. We will respond without undue delay and no later than 45 days after receipt, with a possible 45-day extension if reasonably necessary; we will notify you of any extension and the reason within the initial 45-day period. We may need to verify your identity before acting on a request, and we will not require you to create a new account to submit one. We provide responsive information free of charge up to twice per year; additional or manifestly unfounded, excessive, or repetitive requests may incur a reasonable fee or be declined.
7. Appeal Process
If we decline to act on your request, we will notify you of the reason and provide instructions for appeal within 45 days of your original request. You may appeal by submitting a written request to [insert appeal contact/email]. We will respond to your appeal in writing within 60 days, explaining any action taken or not taken and the reasons for our decision. If your appeal is denied, we will provide you with information on how to submit a complaint to the Office of the Virginia Attorney General.
8. HIPAA and Protected Health Information Notice
In certain matters — including personal injury-adjacent issues, estate planning, or family law matters involving medical records — Magnolia Law may receive, request, or maintain protected health information ("PHI") governed by the Health Insurance Portability and Accountability Act ("HIPAA") and its implementing regulations. PHI is generally exempt from the VCDPA's consumer-rights provisions. Where Magnolia Law receives PHI from a covered entity (such as a medical provider) or engages a vendor that processes PHI on our behalf (such as a records-retrieval or collections vendor), we maintain or require Business Associate Agreements as appropriate to safeguard that information. We limit access to PHI to personnel and agents with a legitimate need related to representation, and we do not use or disclose PHI beyond the scope of the engagement, applicable law, or client authorization.
9. Debt Collection Notices (Fair Debt Collection Practices Act)
If Magnolia Law is contacting you in connection with the collection of a consumer debt, this communication is from a debt collector, and any information you provide will be used for the purpose of collecting that debt, as required by the Fair Debt Collection Practices Act ("FDCPA") and Regulation F. Unless previously provided, you will receive: the amount of the debt; the name of the creditor to whom the debt is owed; notice that you have thirty days from receipt to dispute the debt's validity; notice that if you dispute the debt in writing within that period, we will obtain verification and mail it to you; and notice that, upon written request within thirty days, we will provide the name and address of the original creditor if different from the current creditor. This Section applies only to consumer debt-collection matters and does not apply to commercial collections or other practice areas.
10. Cookies and Tracking Technologies
Our Site may use cookies and similar technologies for functionality and analytics. You may control cookie settings through your browser; disabling cookies may limit certain Site features.
11. Data Retention and Security
We retain personal data only as long as necessary for the purposes described in this policy, client-file retention requirements under the Virginia Rules of Professional Conduct, and other applicable law. We maintain administrative, technical, and physical safeguards designed to protect personal data, though no system is completely secure.
12. Contact Us / Exercising Your Rights
To exercise VCDPA rights, submit an appeal, or ask questions about this policy, contact:
Magnolia Law, P.C.
397 Little Neck Rd.,
3300 S, Ste. 206
Virginia Beach, VA 23452
firm@magnolialawva.com
13. Changes to This Policy
We may update this Privacy Policy periodically. The Effective Date above reflects the most recent revision.