The med spa marketing technology stack: what you need, how to evaluate it and who should run it
A med spa marketing stack has six core parts: a booking system with clinical records, a CRM or lead inbox, call tracking, review management, website and consent capture, and reporting that ties marketing to booked visits. Choose each by the same tests: will the vendor sign a Business Associate Agreement if you need one, does it record where bookings came from, can you export your data, and will someone on your team actually use it. This guide walks through each category and compares all-in-one automation platforms with a managed, healthcare-only approach.
- Six core categories: booking and EMR, CRM and lead inbox, call tracking, review management, website and consent, reporting.
- The first filter for any tool that touches patient information: will the vendor sign a BAA (where HIPAA applies)?
- The stack only works if it captures booking source. Without that, you can't calculate cost per booked consultation.
- All-in-one agency automation platforms are useful for small, cash-pay businesses that do the work in-house; check BAA coverage, healthcare ad-policy knowledge and who does the work.
- Ichelon Consulting US uses its own tools: Angryturtle (Google Business Profile), Prism Spy (ad intelligence), YODA (video) and Ichelon Agency OS (goals and Monday reports).
- Every practice welcome — retainers from $499/mo, Goals-Driven engagements, Performance-Linked Payout Models available.
- Dallas, Texas LLC
- 10-person US client team · Central Time (CST)
- 25+ US healthcare clients
- BAA signed with every client
- HIPAA compliance training across client and delivery teams
- Contracts and invoices in USD
-
Primary Care · North Dallas, TXCase study →
-
MedSpa · North Dallas, TX
-
Skin Care · Beverly Hills, CA
-
Dental · Christiansburg, VACase study →
-
Pediatrics · Blacksburg, VACase study →
-
Pediatric Dentistry · Blacksburg, VACase study →
-
Dental · Roanoke, VACase study →
-
Functional Medicine · Telehealth · USACase study →
“They were able to get all my ideas and work with me over a period of three to four months and create this amazing website. It's super customized, very modern, and it incorporates all the elements that I had wanted — the patient portal, nice pictures, a very interactive website, patient reviews. I would highly recommend their company to anyone who wants to make an excellent website.”
The stack at a glance
Short answer: the clinical system is the center. Everything else either brings people to it (website, Google profile, ads, calls) or reports on what happened in it.
| Category | Job | Touches patient information? |
|---|---|---|
| Booking and EMR | Online booking, schedules, intake, consents, charts, photos, payments | Yes. BAA essential where HIPAA applies. |
| Membership billing | Recurring charges, credits, consent records, cancellation | Often (linked to patient accounts) |
| CRM and lead inbox | Web forms, DMs, missed calls and follow-up in one place | Often (inquiries can include health details) |
| Call tracking | Source of each call, recordings, missed-call alerts | Yes if calls are recorded or transcribed |
| Texting and email | Reminders, rebooking, campaigns, consent and opt-outs | Usually |
| Review management | Review requests, monitoring, replies | Request lists do; public reviews and profile data don't |
| Website, forms and analytics | Service pages, booking links, consent capture, traffic measurement | Forms and tracking can; design them so they don't leak |
| Google Business Profile management | Profile health, local rankings, posts, photos | No (public data) |
| Ad intelligence | What competitors are advertising, offers, creative trends | No (public ad libraries) |
| Reporting | Goals, weekly KPIs, spend vs booked visits | Shouldn't. Use aggregates. |
Six tests for any tool you add
Short answer: privacy terms, source capture, integration, data export, consent handling and whether your team will use it. Features come after these.
- BAA and privacy terms. If HIPAA applies and the tool will hold or transmit protected health information, the vendor must sign a Business Associate Agreement. Ask early; some vendors offer one only on certain plans. If HIPAA doesn't apply, check how the vendor treats health data under state laws such as Washington's My Health My Data Act.
- Source capture. Does it record which link, number or campaign produced each booking or lead, and can that pass into your booking system?
- Integration with the booking system. Two-way sync of appointments avoids double entry and lets you report attended visits, not just form fills.
- Data export. Can you get your patients, leads, consents and history out in a usable format if you leave?
- Consent handling. Texting tools must record consent and honor opt-outs (see the med spa TCPA guide). Membership billing must record consent to recurring charges (see the membership terms guide).
- Who will run it. Every tool needs an owner. An automation nobody maintains sends the wrong message to the wrong patient.
What to look for in each category
Booking and EMR
The system patients book in and providers chart in. For marketing, the essentials are online booking that works well on a phone, deposits and cancellation terms shown before confirming, reminders you can time and word yourself, a field or integration for booking source, and reports you can export weekly. Our review research found booking and communication was the one theme where complaints outnumbered praise across US med spas (54.2% negative), so this system shapes your reputation as much as your ads do.
CRM and lead inbox
Inquiries arrive through web forms, Instagram and Facebook messages, missed calls and texts. A shared inbox with assignment and response-time tracking stops leads going cold. Keep forms short and avoid asking for medical history before booking; move clinical questions into the booking system's intake.
Call tracking
Many people still call before booking. Use separate numbers for your Google Business Profile, website and each paid channel, with missed-call alerts. Recording and transcription help training but bring privacy obligations; if HIPAA applies, the vendor needs a BAA.
Review management
You need a way to ask every patient the same way, monitor new reviews and reply quickly. Google prohibits incentives and selectively asking only happy customers, so avoid "review gating" features that route unhappy patients away from Google. Replies must not confirm anyone is a patient (HIPAA-safe review replies).
Website, forms and analytics
HHS guidance on online tracking technologies warns HIPAA-regulated entities against sending protected health information to tracking vendors without a BAA or patient authorization. Keep ad pixels off booking and intake pages unless reviewed, and don't name conversion events after treatments or conditions. Our HIPAA-safe tracking guide and website checklist cover the setup.
Reporting
Reporting should show goals, weekly KPIs and spend against booked and attended consultations, using counts rather than patient records. The KPI set and formulas are in our med spa KPI dashboard guide.
The tools Ichelon Consulting US builds and uses
Short answer: we build software for the parts of the stack that sit on public or aggregate data, and work alongside the booking, EMR and phone systems our clients already use.
Angryturtle
Google Business Profile software: profile health, local rank tracking, review trends and weekly tasks. Self-serve from $29/month, with a free trial.
Prism Spy
Ad intelligence: what other practices in your specialty are advertising, which offers and formats they use, and how that changes. $149/month per specialty, set up with our US team.
YODA
YouTube planning and measurement for provider-led video, including how videos show up in search and AI answers. Included with managed engagements.
Ichelon Agency OS
Goal tracking and reporting: monthly goals agreed with each client, live pacing and a report every Monday. Included with managed engagements.
We also use AIO Intel for AI search visibility and Prism Pulse for Instagram reporting. Details and pricing are on the US products page.
What we found when we studied 555 US med spas on Google
Patients praise the care almost without exception. The one area where complaints outnumber praise is booking and communication, and that is where most med spas can win.
Full study · 555 US med spas across 20 metros · roughly ±4% nationally · review velocity and themes from a 115-spa subsample · verified against raw data.
All-in-one agency automation platforms vs a managed, healthcare-only approach
Short answer: all-in-one automation platforms give you software to run marketing yourself or through a reseller; a managed, healthcare-only partner gives you people who do the work under healthcare rules. Which fits depends on who in your spa has the time and expertise.
All-in-one agency automation platforms bundle a CRM, forms, texting, email, review requests, booking widgets and simple websites, often resold by marketing agencies under their own brand. They can be a good fit, and it's worth being fair about where:
- Where they help: one log-in instead of five tools, fast follow-up on new leads, automated reminders and review requests, and a low monthly cost for a small, cash-pay spa with an owner or manager who enjoys building workflows.
- Where to look harder: whether a BAA is available and on which plan, how health details in forms, texts and call recordings are handled, whether booking data flows back from your clinical system, and who checks that campaigns follow healthcare ad policies and your state board's rules.
| Criterion | All-in-one automation platform | Managed, healthcare-only approach |
|---|---|---|
| HIPAA and BAA coverage | Varies by vendor and plan; a reseller agency may or may not sign its own BAA. Check both. | Should be standard. Ichelon Consulting US signs a BAA with every US client, and client-facing and delivery teams hold HIPAA compliance training certificates. |
| Healthcare ad-policy expertise | Software doesn't know prescription drug term limits, Meta's health rules or your state board's testimonial rules. Depends on whoever operates it. | Built in. A healthcare-only team works within Google and Meta health policies, FDA and FTC claim rules and state board rules every day. |
| Who does the work | You or your staff (or the reseller), using templates. | The agency team: strategy, campaigns, content, reviews process, reporting. You approve. |
| Reporting on booked visits | Good on leads captured inside the platform; attended visits depend on integration with your booking system. | Should report booked and attended consultations by source, against agreed goals. |
| Compliance review of content | Your responsibility. | Part of the process: claims, before-and-after use, endorsements and tracking reviewed before publishing. |
| Cost structure | Low software subscription; your time is the hidden cost. | Higher monthly fee that includes people. Ichelon Consulting US retainers start from $499/month, custom-scoped, with Goals-Driven engagements and Performance-Linked Payout Models available. |
| Best fit | Small cash-pay spas with an in-house person who has time to run it. | Spas that want outcomes without building a marketing team, or that need healthcare compliance handled. |
The two aren't mutually exclusive. Many practices keep their booking system and an automation tool for reminders, and bring in a managed partner for strategy, ads, content and reporting. What matters is that every piece handling patient information is covered by the right agreement, and that someone accountable checks the marketing against healthcare rules. Our BAA vendor selection guide lists the questions to ask any vendor or agency.
What to fix first
- Source capture and weekly reporting. Tagged booking links, call tracking numbers and a source field. Until this works, you're guessing.
- Missed calls and slow replies. A missed-call alert and a shared inbox often recover more bookings than new ad spend.
- Review requests. A consistent ask to every patient. Benchmarks are in med spa marketing statistics 2026 and the med spa Google presence report.
- Tracking clean-up. Remove pixels from booking and intake pages unless reviewed.
- Then new tools, one at a time, each with an owner and a KPI it should move.
If you're opening a new spa, set these up before launch (see our launch plan). For service-specific marketing, see the injectables and membership guides. More guides are in the US guides library. See how we work or book a call.
Sources
- HHS OCR: Use of online tracking technologies by HIPAA covered entities and business associates
- HHS: Business associate contracts
- 45 CFR 160.103: Definition of business associate
- Washington RCW 19.373: My Health My Data Act
- Google Maps user-contributed content policy (review incentives and selective solicitation)
- 47 CFR 64.1200: TCPA consent rules
- Ichelon Consulting US: State of Med Spa Google Presence 2026
Note: general information, not legal advice. Whether a vendor needs a BAA depends on whether HIPAA applies to you and what data the vendor handles; confirm with counsel.
Related pages from the US team
Med spa KPI dashboard guide
The weekly KPIs this stack should produce.
Ichelon Consulting US software
Angryturtle, Prism Spy, YODA, AIO Intel, Prism Pulse and Ichelon Agency OS.
New med spa launch plan
When to set each system up before opening.
BAA vendor selection guide
What to check before signing with a marketing vendor.
HIPAA-safe website tracking
Pixels, analytics and what to send.
Med spa marketing agency USA
How Ichelon Consulting US runs med spa marketing.
Every practice welcome — Goals-Driven engagements from $499/mo
We benchmark your last 90 days, agree monthly goals with you, and track them live on Ichelon Agency OS with a report every Monday. Performance-Linked Payout Models are available. Our US leadership is based in Dallas, and strategy calls run in US business hours.
Common questions
What software does a med spa need for marketing?
At minimum: a booking system with clinical records and online booking, a way to manage leads and follow-ups, call tracking, a review request and reply process, a website with consent capture for texts and email, and reporting that connects ad spend to booked and attended consultations. Add membership billing if you sell memberships.
Does every med spa tool need a BAA?
Only if HIPAA applies to your practice and the tool creates, receives, maintains or transmits protected health information on your behalf. Booking systems, EMRs, call recording, texting and CRMs often do. Tools that only see aggregate or public data, such as a Google Business Profile tool, usually do not. Even if HIPAA does not apply, state health privacy laws may.
Are all-in-one marketing automation platforms good for med spas?
They can be, especially for small cash-pay spas with an owner or manager who will build and run the automations. Before choosing one, check whether the vendor will sign a BAA, how health information is handled in forms, texts and call recordings, whether booking data flows back from your clinical system, and who will keep campaigns compliant with healthcare ad policies.
How do we connect marketing to booked appointments?
Capture the source at booking with tagged links, call tracking numbers and a required source field, then report weekly counts of bookings and attended visits by source next to spend. You do not need to move patient records into marketing tools to do this.
Should a med spa replace its stack all at once?
Rarely. Start by fixing source capture and reporting, since that tells you what is working. Then replace the tool causing the most lost bookings or manual work, usually phone handling, lead follow-up or review requests.
A note on this guide: it explains marketing practice, not legal advice. Rules on privacy, advertising and insurance change and vary by state, so confirm anything compliance-related with your own counsel.
Not sure which parts of your stack are costing you bookings?
Book a 30-minute benchmarking call. A member of our Sr. Leadership team will map your current systems and show you where source data and bookings are being lost.
We cover every stage, from first search to repeat visit
- 0Foundations
- 1Demand gen
- 2Capture
- 3Lead quality
- 4Lead mgmt
- 5Scheduling
- 6Show-up
- 7Conversion
- 8Retention
We work across all nine stages, from foundations to past patients, and fix the stage that leaks first. Our own software runs the work, and every stage is reported against a monthly target on Ichelon Agency OS.
See all nine stages and the tool behind each one →