What are the red flags when hiring a med spa marketing agency?
The biggest red flags are an agency that keeps your ad accounts or website, will not sign a Business Associate Agreement, guarantees rankings or results, offers fake or incentivized reviews, or reports clicks instead of booked consultations. Check for them before signing, not after the first invoice.
- Ownership: you should own ad accounts, Google Business Profile, domain, analytics and tracking numbers.
- Compliance: no BAA, tracking pixels on booking pages, or bought reviews are dealbreakers.
- Guarantees: nobody can guarantee a Google ranking or a set number of patients.
- Reporting: an agency that cannot show consultations and bookings by channel is reporting activity, not results.
- Every practice welcome — retainers from $499/mo, Goals-Driven engagements, Performance-Linked Payout Models available.
- Dallas, Texas LLC
- US client team · Central Time (CST)
- 25+ US healthcare clients
- BAA signed with every client
- HIPAA compliance training across client and delivery teams
- Contracts and invoices in USD
-
Primary Care · North Dallas, TXCase study →
-
MedSpa · North Dallas, TX
-
Skin Care · Beverly Hills, CA
-
Dental · Christiansburg, VACase study →
-
Pediatrics · Blacksburg, VACase study →
-
Pediatric Dentistry · Blacksburg, VACase study →
-
Dental · Roanoke, VACase study →
-
Functional Medicine · Telehealth · USACase study →
“They were able to get all my ideas and work with me over a period of three to four months and create this amazing website. It's super customized, very modern, and it incorporates all the elements that I had wanted — the patient portal, nice pictures, a very interactive website, patient reviews. I would highly recommend their company to anyone who wants to make an excellent website.”
Which red flags should rule out a med spa marketing agency?
Rule out any agency that controls your accounts, avoids a Business Associate Agreement, promises guaranteed outcomes, suggests fake or paid reviews, or cannot tie its work to booked treatments. These are not style differences. Each one creates a financial, legal or reputational risk that a med spa carries long after the contract ends.
| Red flag | Why it matters for a med spa | What to ask for instead |
|---|---|---|
| Agency owns the ad accounts | You lose campaign history and data if you leave | Accounts in your name, agency added as a user |
| Refuses or delays a BAA | Patient data in forms, calls or CRM may be exposed | A signed BAA before any patient data is shared |
| Guaranteed rankings or patient counts | No one controls Google's results or patient decisions | Agreed goals with a clear plan and weekly tracking |
| Review packages or review gating | Fake or bought reviews fall under the FTC's 2024 rule; selective requests can mislead and break Google's policies | An honest review-request routine sent to all patients |
| Reports only impressions and clicks | Activity can rise while bookings fall | Consultations and booked treatments by channel |
| Long lock-in with no exit terms | You keep paying for poor results | Clear notice period and a written handover plan |
| Bold claims in ad copy | State boards and the FTC police misleading health claims | A claims review process for every ad and page |
Which contract and ownership terms should worry a med spa owner?
Worry about any term that makes leaving expensive or slow: agency-owned ad accounts, websites built on a platform only the agency can edit, tracking phone numbers registered to the agency, and auto-renewing terms with long notice periods. Read the contract for what you keep on exit, not just what you get on day one.
- Ad accounts: Google Ads and Meta business accounts should be created in the spa's name with your payment method or a transparent pass-through.
- Website: you should hold the domain, hosting login and a copy of the site files or a clean export.
- Google Business Profile: the spa should be the primary owner; the agency should be a manager.
- Call tracking: ask whether you can keep or port tracking numbers that appear on listings and ads.
- Creative: photos, videos and copy you paid for should be yours to reuse.
- Exit: the contract should name a handover window and what files the agency delivers.
If you are already stuck in one of these setups, our guide to switching med spa marketing agencies walks through a safe handover.
What compliance red flags are specific to med spas?
Med spa compliance red flags include no BAA, Meta or Google tracking pixels firing on booking and intake pages, review schemes, before-and-after photos used without written patient consent, and ad copy that overstates results for injectables, lasers or weight-loss programs. These carry HIPAA, FTC and state board risk for the spa, not just the agency.
Tracking and patient data
HHS Office for Civil Rights issued guidance on online tracking technologies in December 2022, updated in March 2024. A federal court in June 2024 vacated the part covering unauthenticated public pages, but tracking on authenticated pages such as patient portals is still covered. Booking and intake flows remain a sensitive area. An agency that drops pixels everywhere without asking where patient information flows is a red flag.
Reviews and testimonials
The FTC's rule banning fake reviews and testimonials took effect in October 2024, and the FTC Endorsement Guides were revised in 2023. The rule covers fake reviews, reviews bought on condition of a particular sentiment, undisclosed reviews by company insiders, and review suppression through threats or intimidation. Sending requests only to patients expected to leave five stars also breaks Google's policies and can mislead. Any agency suggesting these should end the conversation.
Claims
Claims about outcomes, safety or product approval status need support, and state medical boards set their own advertising rules. Ask how the agency checks claims before launch. Confirm specific questions with your own counsel. Our HIPAA guide for agencies and vendors lists what to require.
What reporting red flags show up after the contract is signed?
The clearest reporting red flag is a monthly report full of impressions, clicks, reach and follower counts with no line for consultations requested, consultations booked or treatments sold. Other warning signs are reports that change format every month, missing ad spend figures, and no answer to the question of which channel produced last month's new patients.
- Calls are counted but not listened to or classified, so spam and existing patients inflate the numbers.
- Form fills are reported, but nobody checks how many became booked appointments.
- The agency cannot see or will not ask for booking data from your scheduling system.
- Cost per lead is reported without cost per booked consultation.
- Meetings are skipped or replaced by a PDF with no commentary.
Watch the relationship as well as the numbers. If your account manager changes every few months, if questions take a week to answer, or if nobody can explain why a campaign was paused, the agency is stretched thin. Ask who exactly works on your account and how many hours a month the retainer buys.
A good report connects spend to booked revenue by service. Our med spa marketing ROI guide shows which numbers to ask for.
What we found when we studied 555 US med spas on Google
Patients praise the care almost without exception. The one area where complaints outnumber praise is booking and communication, and that is where most med spas can win.
Full study · 555 US med spas across 20 metros · roughly ±4% nationally · review velocity and themes from a 115-spa subsample · verified against raw data.
What do guarantees and pricing tell you about an agency?
Guarantees of a first-page ranking, a fixed number of new patients or a set return on ad spend tell you the agency is selling, not planning. Google controls rankings and patients control bookings. A credible agency commits to goals, a clear plan, transparent spend and fast reporting, and explains what happens if goals are missed.
Pricing tells you something too. Watch for:
- A retainer far below the work described, which often means templated campaigns and little attention.
- Ad spend bundled into the fee with no visibility into what Google or Meta actually received.
- Large setup fees that are not tied to a written deliverable list.
- Package names with no scope underneath them.
Also ask how the agency handles weeks when the spa is fully booked or a provider is away. A partner that keeps spending at full pace when there is no capacity to take new consultations is optimizing its own activity, not your business. Budgets should flex with provider calendars and seasonal demand.
Performance-based pricing is not a red flag in itself. It works when goals, tracking and payout terms are written down and both sides can see the same data.
How can a med spa check an agency before signing?
Check an agency by asking for a sample report, a draft BAA, the contract's exit terms and a plain explanation of who will own each account. Then ask how they would track a consultation from first click to booked treatment. Clear, specific answers are a good sign. Vague answers on any of these are a red flag.
- Ask for a redacted sample monthly report from a similar practice.
- Ask for the BAA and read it before the main contract.
- Ask who will work on the account each week, and in which time zone.
- Ask how they review ad claims for injectables, lasers and weight-loss programs.
- Ask what you receive if you leave in month three.
Ichelon Consulting US signs a BAA with every US client and reports against agreed monthly goals every Monday, and we recommend every spa keep its ad accounts in its own name. See how our med spa marketing agency work is scoped, or book a call and bring your current contract for a second opinion.
Related pages from the US team
Med spa marketing agency USA
How Ichelon Consulting US scopes med spa work.
Switching med spa agencies
How to move accounts and data safely.
HIPAA for agencies and vendors
What practices should require before sharing data.
Med spa marketing ROI
The numbers a good report should show.
Every practice welcome — Goals-Driven engagements from $499/mo
We benchmark your last 90 days, agree monthly goals with you, and track them live on Ichelon Agency OS with a report every Monday. Performance-Linked Payout Models are available. Our US leadership is based in Dallas, and strategy calls run in US business hours.
Common questions
Is it a red flag if a med spa marketing agency owns the ad account?
Yes. If the agency owns the Google Ads or Meta ad account, the med spa can lose years of campaign history, audiences and conversion data when the relationship ends. Accounts should be created in the spa's name, with the agency added as a user. Ask for this in writing before any campaign launches, and move existing accounts across if needed.
Should a med spa marketing agency sign a BAA?
If the agency will see or handle patient information, such as form submissions, call recordings, CRM records or email lists, the med spa should have a signed Business Associate Agreement before sharing it. An agency that avoids or delays a BAA is a red flag. Confirm the exact scope with your own counsel, since needs vary by setup.
Can a marketing agency guarantee first-page Google rankings for a med spa?
No. Google decides rankings, and no agency controls its algorithm. A guaranteed ranking usually means the agency targets obscure phrases nobody searches or relies on tactics that can backfire. A credible agency agrees measurable goals, such as booked consultations by service, explains its plan, and reports progress openly instead of promising positions.
Is it legal for an agency to post reviews for a med spa?
Generally no. The FTC rule on fake reviews and testimonials, effective October 2024, prohibits fake reviews, reviews paid for on condition of a positive or negative sentiment, and undisclosed reviews by company insiders. Google's policies also ban fake engagement. Any agency offering review packages is a red flag. An honest routine asks every patient for feedback, without incentives or filtering. Confirm specifics with your counsel.
What should a med spa agency report every month?
At minimum: ad spend by platform, leads by channel, consultations requested, consultations booked, treatments sold where known, and cost per booked consultation. It should also note what changed, what was tested and what comes next. Reports that show only impressions, clicks and followers describe activity and are a warning sign about the agency's focus.
A note on this guide: it explains marketing practice, not legal advice. Rules on privacy, advertising and insurance change and vary by state, so confirm anything compliance-related with your own counsel.
Want a second opinion on an agency contract?
A call with the US team. Bring your proposal or current contract and we will point out ownership, compliance and reporting gaps.
We cover every stage, from first search to repeat visit
- 0Foundations
- 1Demand gen
- 2Capture
- 3Lead quality
- 4Lead mgmt
- 5Scheduling
- 6Show-up
- 7Conversion
- 8Retention
We work across all nine stages, from foundations to past patients, and fix the stage that leaks first. Our own software runs the work, and every stage is reported against a monthly target on Ichelon Agency OS.
See all nine stages and the tool behind each one →