AI for Med Spas: Booking, Follow Up and Reviews Without HIPAA Headaches

AI for med spas pays off in a few specific places: answering new inquiries fast, booking consults, sending pre and post treatment instructions your medical director has approved, reminding clients when they are due to rebook, and drafting review replies. The risks are just as specific. Client records are medical information, California regulates AI generated patient messages and treatment photos, and any vendor touching that data needs the right contract. This guide covers both sides.

First, remember what a med spa is legally

The Medical Board of California puts it bluntly: "Medical spas are marketing vehicles for medical procedures. If they are offering medical procedures, they must be owned by physicians." The Board adds that, in reality, "it is the practice of medicine."

That framing matters for AI. Your intake forms, chart notes, photos and even your rebooking texts are communications from a medical practice. Software that is fine for a hair salon is not automatically fine for you.

Five places AI for med spas earns its keep

1. Fast replies to new inquiries

Someone filling out a form at 10 pm about lip filler may be comparing several providers. An AI receptionist or chat tool can answer basic questions (hours, location, which services you offer, how consults work) and offer consult times. Med spa platforms now build this in: Boulevard lists an AI Receptionist alongside booking, forms and charts, and Zenoti advertises an AI Receptionist for medspas. Set firm limits: anything about candidacy, medications, pregnancy, allergies or a reaction goes to a licensed person.

2. Consult booking and deposits

Let the tool book consults, collect deposits and send intake forms. Keep treatment decisions out of it. The consult is where a licensed provider decides what is appropriate.

3. Pre and post treatment instructions

AI should not write medical instructions from scratch. Have your medical director approve a master version for each treatment, then use AI only to reformat it into text message length, adjust the reading level, or translate it, with a human checking the result.

California adds a rule here. Health and Safety Code section 1339.75 requires a health facility, clinic, physician's office or physician group practice that uses generative AI to create patient communications about clinical information to include a disclaimer and instructions for reaching a human. The requirement does not apply if a licensed or certified provider reads and reviews the message first, and purely administrative messages such as scheduling and billing are outside the definition. The Medical Board's summary says the law took effect January 1, 2025. A physician owned med spa may well be covered. The simplest compliant habit: a licensed person reviews every clinical message before it goes out.

4. Rebooking reminders

AI can draft reminders keyed to the intervals your providers set ("most clients rebook around this time; reply to book"). Keep reminders about a client's own care separate from promotional blasts. HHS says that, with limited exceptions, HIPAA requires a patient's written authorization before their information is used for marketing. Ask your compliance advisor where your promotions fall.

5. Review replies and charting

AI can draft calm, generic review replies, but never confirm the reviewer is a client or mention a treatment. Our guide to responding to Google reviews with AI has a checklist. On the clinical side, Zenoti advertises an AI Scribe that drafts SOAP notes and treatment summaries for medspa providers; treat any generated note as a draft the provider reviews and signs.

HIPAA, California privacy law and the BAA question

Some med spas are HIPAA covered entities and some are not. HHS says health care providers are covered entities only if they transmit any information in an electronic form in connection with a transaction for which HHS has adopted a standard. A cash only med spa that never sends those electronic transactions may fall outside that definition, so ask your compliance advisor which side you are on.

That does not leave you unregulated. California's Confidentiality of Medical Information Act covers any provider of health care licensed under Division 2 of the Business and Professions Code, which includes physicians, nurses and physician assistants, and Civil Code section 56.10 says a provider "shall not disclose medical information regarding a patient" without authorization, except as the law allows.

The practical rule: treat client data as protected, use AI tools only from vendors that will sign a business associate agreement or equivalent written privacy terms, and keep client details out of general chatbots. OpenAI, for example, says it does not offer a BAA for ChatGPT Business. Our plan by plan look at whether ChatGPT is HIPAA compliant covers the options. Confirm with your attorney or compliance advisor how HIPAA and California law apply to your practice.

Before and after photos: keep AI away from them

California Business and Professions Code section 651 treats an ad as misleading if it uses "any photograph or other image that does not accurately depict the results of the procedure being advertised or that has been altered in any manner from the image of the actual subject." It also requires before and after views to state what procedures were performed, to be comparable in poses and lighting, and to include a statement that the same results may not occur for all patients. Images of a model must be clearly labeled as a model.

So: no AI retouching of result photos, no AI generated "after" images, and no AI faces presented as your results. Also note that full face photographs are on HHS's list of identifiers that make information identifiable, so get written permission before any client photo appears in marketing.

How to set it up in two weeks

1. Choose one job. For most med spas that is after hours inquiry response and consult booking.
2. Check what your booking platform already includes before buying a separate tool.
3. Get the contract right. Ask for a BAA or written privacy terms, and a list of subcontractors.
4. Write the handoff list: candidacy, medications, pregnancy, reactions, complaints and refunds go to a person.
5. Load only approved content: services, policies, and aftercare text signed off by your medical director.
6. Test 20 conversations yourself, including a client describing swelling after filler. The right answer is a fast handoff, not advice.
7. Run it for two weeks and read every conversation.

What to watch out for

• Results claims. Do not let AI write "flawless," "no downtime" or "permanent" copy. Section 651 also covers claims that create unjustified expectations of results.
• Clinical drift. Clients will ask chat tools medical questions. The script must route them to a licensed provider.
• Photo editing defaults. Some camera and editing apps can smooth or filter images by default. Check the settings on any device used for clinical photos.
• Vendor badges. A "HIPAA compliant" label on a website is not a signed agreement.

Where to start

Start with inquiry response and consult booking inside the platform you already use, with a written handoff list and a two week review. For help choosing the first job, see our AI assessment or our AI consulting services. Dental practices can use the companion guide, AI for dental offices.