Med spa KPIs: the weekly dashboard, with formulas and where to get each number

The ten weekly KPIs and their formulas

Short answer: five groups. Demand (are people booking?), conversion (do they show up and buy?), retention (do they come back?), capacity (are providers busy?) and reputation (does Google trust you?).

Add two monthly measures once the weekly ten are reliable: cost per attended consultation by channel (spend ÷ attended consultations) and revenue per patient over 12 months for each acquisition channel. The second tells you which channels bring patients who come back.

Retention and capacity: where profit is made

Short answer: acquiring a med spa patient is expensive; the second and third visits are where it pays back. Rebooking rate, membership churn and provider utilization tell you whether that's happening.

• Rebooking rate is the single most useful retention number for treatments with a natural rhythm, such as neurotoxin, facials and laser series. Track it by provider and by service.
• Membership churn compounds. At 5% a month, members stay about 20 months on average (1 ÷ churn); at 10%, about 10. Pair it with credit usage, which falls before cancellations rise. Our membership guide has a retention routine.
• Provider utilization tells you whether to spend more on marketing or fix the schedule. If utilization is high, more ads mean longer waits; if it's low on certain days, run targeted campaigns or adjust hours. In our study, 74.2% of US med spas were open at least one weekend day, averaging 5.6 days a week.

Building the dashboard without exposing patient data

Short answer: a marketing dashboard needs counts, not people. Pull aggregates out of clinical systems, and keep identifiable information inside tools covered by the right agreements.

1. Decide whether HIPAA applies. Med spas that bill health plans electronically are usually covered entities; many cash-only spas are not. Either way, state health privacy laws (Washington's My Health My Data Act, for example) and the FTC Act can apply to health information, so treat it carefully regardless.
2. Export aggregates from the booking system: weekly counts of bookings by source, attended visits, rebookings, cancellations and booked hours. No names, phone numbers or treatment notes in the dashboard.
3. Sign BAAs where needed. If any reporting, call tracking or CRM tool receives identifiable patient information and HIPAA applies, it needs a Business Associate Agreement. Ichelon Consulting US signs a BAA with every US client.
4. Keep health details away from ad platforms. HHS guidance on online tracking technologies warns that sending protected health information to tracking vendors without a BAA or authorization can violate HIPAA. Don't fire treatment-specific events to ad pixels, and get legal advice before uploading patient lists for ad matching. See our HIPAA-safe tracking guide.
5. Small numbers are identifying. A weekly report showing one patient booked for a rare treatment from a small town is effectively a record. Group small categories.
6. Limit access. Give marketing staff and agencies the dashboard, not log-ins to the EMR.

Sources

• Ichelon Consulting US: State of Med Spa Google Presence 2026 and methodology
• HHS OCR: Use of online tracking technologies by HIPAA covered entities and business associates
• HHS: Business associate contracts
• Washington RCW 19.373: My Health My Data Act
• Google Business Profile Help: Performance and insights

Note: general information, not legal advice. Whether HIPAA applies to your med spa, and what you can share with marketing vendors, depends on your billing and structure; confirm with counsel.

Common questions

A note on this guide: it explains marketing practice, not legal advice. Rules on privacy, advertising and insurance change and vary by state, so confirm anything compliance-related with your own counsel.