Privacy Policy

1. Introduction

Justin D. Leigh, PLLC, d/b/a Law Office of Justin D. Leigh ("I," "me," or "my") respects your privacy and is committed to protecting the personal information you share with me. This Privacy Policy explains how I collect, use, disclose, and safeguard your information when you visit my website justindleigh.com, my client portal at portal.justindleigh.com, or use any of my online services.

2. Information I Collect

I may collect the following categories of personal information:

• Contact Information: Name, email address, phone number
• Case Information: Subject matter of inquiry, description of legal matter, opposing party names, court case numbers, whether a real estate inquiry
• Referral Information: How you heard about my office
• Consultation Preferences: Preferred date and time for consultation
• Client Portal Data: Documents you upload, case status information, messages between you and my office
• Technical Data: IP address, browser type, device information, pages visited, session duration, and approximate location collected automatically through Google Analytics and server logs when you visit my site

3. How I Collect Information

• Directly from you when you submit a contact form, consultation request, or AI inquiry form
• Through my client portal when you upload documents or communicate with my office
• Through Google Local Service Ads when you contact me via a Google LSA listing (note: Google may record these calls; see Section 9)
• Through my phone system when you call my office (calls may be recorded for quality and documentation purposes)
• Automatically through Google Analytics, cookies, and similar technologies when you browse my website

4. How I Use Your Information

• To respond to your inquiries and provide legal services
• To evaluate potential conflicts of interest before establishing representation
• To communicate with you about your legal matter
• To manage your account on my client portal
• To send you important notices regarding your case or my services
• To analyze website usage and improve my services (via Google Analytics)
• To comply with legal and ethical obligations

5. How I Store and Protect Your Information

Your information is stored using Supabase, a SOC 2 Type II certified cloud database platform with encryption at rest and in transit. My website and client portal are served over HTTPS with TLS encryption. Access to client data is restricted to authorized personnel only through role-based access controls and multi-factor authentication.

While I implement commercially reasonable security measures, no method of electronic storage or transmission is 100% secure. I cannot guarantee absolute security of your information.

6. Third-Party Service Providers

I use the following third-party services that may process your personal information:

• Supabase: Database hosting, authentication, and file storage. Processes all personal information submitted through forms and the client portal.
• Vercel: Website and client portal hosting. Processes HTTP requests and may log IP addresses.
• Resend: Transactional email delivery. Processes email addresses and message content for emails sent from my office (hello@justindleigh.com).
• Google: Analytics (anonymized usage data including pages visited, session duration, and approximate location), Maps (embedded map on contact page), Calendar (appointment scheduling), OAuth (portal login authentication), and Local Service Ads.
• Quo (formerly OpenPhone): Phone system with call recording and AI-powered transcription.

I do not sell, rent, or trade your personal information to third parties for marketing purposes.

7. Cookies and Tracking Technologies

My website uses Google Analytics (ID: G-6QB7N65Z8X) to collect anonymized usage data, including pages visited, session duration, general geographic location, and device information. This helps me understand how visitors use my site and improve my services. Google Analytics may set cookies to distinguish users. I do not use cookies for advertising or targeted behavioral profiling.

My website also uses the Google Maps embed on my contact page, which may set its own cookies subject to Google's privacy policies.

You can opt out of Google Analytics using the Google Analytics Opt-out Browser Add-on. Your browser settings also allow you to manage or disable cookies.

8. Your Rights

Residents of Washington, California, and other jurisdictions may have the following rights regarding their personal information:

• Access: Request a copy of the personal information I hold about you
• Correction: Request correction of inaccurate personal information
• Deletion: Request deletion of your personal information, subject to legal and ethical retention obligations
• Portability: Request your data in a portable format

To exercise any of these rights, please contact me using the information in Section 14. I will respond to your request within 45 days.

9. Google Local Service Ads

If you contact me through a Google Local Service Ad, please be aware that Google may record the phone call. These recordings are stored by Google and are subject to Google's own privacy policies. Call recordings made by Google through Local Service Ads are not protected by attorney-client privilege. An attorney-client relationship is not established through an initial contact via Google Local Service Ads.

Google typically retains LSA call recordings for approximately 60 to 70 days. Google's Terms of Service govern the storage, use, and deletion of these recordings, and Google retains certain rights over LSA-related content under those terms. If you wish to communicate confidential information, please contact my office directly after a formal engagement has been established.

10. Consumer Health Data Privacy Policy (Washington State)

This section constitutes my Consumer Health Data Privacy Policy as required by the Washington My Health My Data Act (RCW 19.373).

Categories of Health Data Collected: Information submitted through my intake forms may include consumer health data such as descriptions of injuries, disabilities, medical conditions, mental health status, or other health-related information relevant to your legal matter (including but not limited to personal injury claims, disability discrimination matters, family law proceedings, and workers' compensation cases).

Purpose of Collection: I collect consumer health data solely to evaluate and provide legal services that you have requested or inquired about.

Third Parties: Consumer health data may be stored by Supabase (my database provider) as part of your case records. I do not sell consumer health data to any third party.

Your Rights: You have the right to: (1) confirm whether I am collecting or sharing your consumer health data; (2) access your consumer health data; (3) withdraw consent for future collection of health data not necessary to provide legal services; and (4) request deletion of your consumer health data, subject to my legal and ethical retention obligations.

How to Exercise Your Rights: Contact Justin D. Leigh directly at (509) 426-4415 or justindleigh@gmail.com to exercise any rights under the My Health My Data Act. I will respond within 45 days.

11. Data Breach Notification

In the event of a data breach affecting your personal information, I will notify you in accordance with applicable state and federal law, including Washington's data breach notification statute (RCW 19.255.010), in the most expedient time possible and without unreasonable delay.

12. Children's Privacy

My website and services are not directed to individuals under the age of 13. I do not knowingly collect personal information from children under 13. If I become aware that I have collected such information, I will take steps to delete it promptly. If you believe a child under 13 has provided me with personal information, please contact me immediately.

13. Data Retention

I retain personal information for as long as necessary to fulfill the purposes for which it was collected, to comply with my legal and ethical obligations (including bar association record-keeping requirements), to resolve disputes, and to enforce my agreements. For prospective clients who do not engage my services, I generally retain contact information for conflict-checking purposes as required by the Washington Rules of Professional Conduct.

14. Contact Me

If you have questions about this Privacy Policy, wish to exercise your rights, or have concerns about my data practices, please contact:

15. Changes to This Policy

I may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated "Last Updated" date. Your continued use of my website after any changes constitutes acceptance of the revised policy.