Medspa membership terms of service — CA ARL, Vermont, Illinois, DC, New York and the state medical board layer

Why medspa memberships attract a three-layer legal framework

A medspa membership is not a simple retail subscription. It is a recurring consumer contract that (a) charges a payment method automatically on a recurring cycle, (b) bundles or discounts services that in many cases are physician-directed medical treatments, and (c) may include treatment credits, unused-visit rollovers, or discounted access to procedures. Each of those characteristics attracts a different regulator.

The subscription-law layer, largely state, focuses on the auto-renewal — the mechanism that keeps charging the card until the member cancels. The federal layer at ROSCA and the FTC 2024 negative-option rule adds a national floor on disclosure and click-to-cancel. The state medical board layer focuses on whether the membership includes physician-directed services and whether the structure complies with anti-fee-splitting, corporate-practice-of-medicine and misleading-advertising rules. And the payment-processor layer, driven by Stripe's, Adyen's and Square's terms of service and by the card-network dispute rules, drives operational configuration.

The interaction — where each layer bites

Every membership sign-up page needs to satisfy the subscription-law layer. Every membership contract needs to sit inside a corporate structure that passes the state medical board layer. Every recurring charge needs to pass the payment-processor layer. Break one and the programme cannot ship at scale — a launch that satisfies the marketing team's growth plan but fails the state medical board layer will be dismantled within months of the first complaint.

The FTC layer — ROSCA and the 2024 negative-option rule

The federal Restore Online Shoppers Confidence Act at 15 USC 8401-8405 sets a national floor on online recurring-charge disclosure. Its core requirements are: clear and conspicuous disclosure of the material terms before obtaining billing information, express informed consent to the recurring-charge feature specifically, and a simple mechanism for the consumer to stop the recurring charges. The FTC has enforced ROSCA aggressively — the 2023 Notice of Penalty Offenses on Subscription Practices put a broad set of large advertisers on formal notice that specific conduct is unlawful, unlocking civil penalties at approximately USD 50,120 per violation.

The FTC's 2024 Rule Concerning Recurring Subscriptions and Other Negative Option Programs, adopted October 2024, is the successor to the older Negative Option Rule. It codifies clear-and-conspicuous disclosure requirements, requires affirmative consent to the negative-option feature specifically, requires a simple cancellation mechanism at least as accessible as enrolment (the "click-to-cancel" provision), and requires that consent be maintained in a retrievable record for a specified retention period.

What clear and conspicuous means at the FTC

• Prominent placement of the disclosure — not buried in a linked policy, not below the fold, not in a smaller font than the surrounding text.
• Unavoidable — the consumer sees it before or at the point of consent.
• Understandable — plain-language description of the recurring charge, the frequency, the amount, and how to cancel.
• Not contradicted — no other text on the page suggests the charge is one-time or that cancellation is more restrictive than the disclosure states.

Stripe, JaneApp, Zenoti, Boulevard and Aesthetic Record — configuring the recurring-charge layer

The payment-processor layer is where the subscription-law and medical-board decisions become operational. Every recurring charge on a Stripe billing product, an Aesthetic Record subscription, a JaneApp membership, a Zenoti recurring package or a Boulevard membership plan needs to be configured so that the technical behaviour matches the legal disclosure.

• Plan name and description. The plan name on the customer's card statement descriptor should be recognisable — a member who sees a charge on their card should be able to identify it as the medspa membership, not a generic descriptor.
• Itemised recurring price. Where the membership includes distinct components (member visit credit, retail credit, discount access), the invoice should itemise them where the payment-processor supports it, so a dispute or a state audit can reconstruct the charge.
• Cancellation at anywhere. A member cancellation initiated at the front desk, through the practice's website, or by email must propagate to the payment processor within one business day so the next scheduled charge does not fire.
• Pre-charge notice. For memberships with terms of one year or longer, or where state law requires it, an automated email is sent to the member a specified number of days before the annual renewal charge.
• Failed-payment handling. A card decline should trigger a written notice to the member with time to update, not automatic downgrade or silent access removal.
• Retention of consent artefacts. The exact copy of the sign-up disclosure, the timestamp, the IP and the accepted terms are retained in the member record for the FTC-standard retention period plus state overlays.

Where membership sits in the medspa compliance stack