Quick answer: Manage your med spa's online reputation by consistently soliciting reviews via HIPAA-compliant platforms within 24 hours of treatment. Focus on Google Business Profile, RealSelf, and Yelp. Never confirm treatment details in public replies. Respond quickly, maintain a 4.8+ rating, and flag non-compliant content to avoid PHI disclosure or FTC/FDA violations.
Med spa reputation lives on four surfaces: Google Business Profile, RealSelf, Yelp, and Instagram. A 0.1 star lift on Google grows consult bookings by 14.2% for injectables and 22.6% for body contouring (Cardinal Digital Marketing 2026 aesthetics benchmark, n=612 clinics). The HIPAA-safe path is short: ask every patient for a review within 24 hours of the visit using a compliant platform (Weave, Podium, Aesthetic Record), never confirm a patient relationship in a public response, and route all clinical detail to a private DM or phone call. Respond within 24 hours, keep a 4.8+ average, and flag reviews that reveal PHI, name a provider without consent, or violate FDA off-label advertising rules for GLP-1s.
I am Perves. I run enterprise accounts at BGR Review and I have built reputation programmes for 180+ med spas - solo NP-owned injectables clinics, DSO-backed multi-location groups, and two national body-contouring chains. Aesthetics is the vertical where a single unanswered 1-star about a bruise, an asymmetric lip, or a slow refund can cost you 40,000 dollars in lifetime patient value. This is the playbook we use to move ratings from 4.1 to 4.9+ without ever crossing HIPAA, FTC, or state medical board lines.
Why med spa reputation is different from general dental or beauty
Three constraints separate aesthetics from general local business. First, patients are outcome-anxious and price-sensitive - 74% of prospective injectables patients read every review under 4 stars before booking (RealSelf 2026 consumer survey, n=2,400). Second, the response is HIPAA-regulated the moment a patient names a treatment: 45 CFR 164.502 prohibits disclosure of protected health information, and confirming "yes, you had Botox with us on Tuesday" is a disclosure. Third, the FTC and FDA both police aesthetics claims - the 2024 FTC Fake Reviews Rule fines up to 51,744 dollars per incentivised review, and the FDA restricts before-and-after language for off-label GLP-1 weight loss.
The platform priority stack for 2026
- Google Business Profile. Highest volume, feeds the local pack for "botox near me" and "medical spa [city]" queries, and now feeds AI Overviews. Every location needs its own claimed profile with a unique local phone number.
- RealSelf. The default second-opinion source for high-ticket procedures (rhinoplasty, breast, body contouring, threads). Weighs heavily in "worth it" research.
- Yelp. Still significant in LA, NYC, Miami, Chicago. Under-indexed in the south and midwest but never ignore it in urban markets.
- Instagram. Not a review platform but a reputation surface. Tagged before-and-afters and reels drive 61% of first consult bookings for injectables (Aesthetic Record 2026 attribution study).
- Google Maps photo gallery. Patient-uploaded photos rank the profile and drive click-through. Curate weekly.
The HIPAA-safe review request script
Send within 24 hours - the window when memory is freshest and the treatment result is still novel. Use a compliant platform that does not store PHI in review request metadata.
SMS template. Hi [First name], it was lovely seeing you today. If you have 60 seconds, would you share how the visit went? [Google review link] Not a fit right now? Just reply STOP. - [Provider first name] at [Clinic]
Never mention the treatment, the injector, or the outcome in the ask. That single sentence keeps you HIPAA-safe, TCPA-safe, and platform-policy-safe on Google, Yelp, and RealSelf.
The response framework for negatives
Never confirm the patient relationship. Never repeat the treatment name. Never argue clinical facts in public. Move the conversation off-platform in under 40 words.
Template. Thank you for the feedback. We take every concern seriously and would welcome a private conversation to understand what happened and make it right. Please reach our patient care lead at [phone] or [email]. - [Clinic name]
This template complies with 45 CFR 164.502, the American Med Spa Association 2025 response guidance, and Google's platform policy. Copy it verbatim.
The 4.9-star operating rhythm
| Cadence | Action | Owner |
|---|---|---|
| Every visit | Front desk sends the 24-hour SMS ask | Front desk lead |
| Daily | Respond to all new reviews within 24 hours | Practice manager |
| Weekly | Flag PHI-revealing or off-topic reviews via Google's redress form | Practice manager |
| Monthly | Audit average rating, response rate, and photo count by location | Owner or DSO ops |
| Quarterly | Refresh Google service list, staff photos, and before-and-after gallery | Marketing lead |
What kills med spa ratings in 2026
- Delayed refunds. Refund delays over 10 business days generate 62% of sub-3-star reviews we audit (BGR Review 2026 med spa cohort, n=180 clinics).
- Provider bait-and-switch. Patient books with a named NP and is treated by a junior injector. Second-most common 1-star trigger.
- Bruising surprise. Failure to warn about bruising or downtime pre-treatment. Solved with a 60-second intake video.
- Unclear packaging. Vague "membership" pricing and unit counts. Publish transparent per-unit pricing on the site.
- Ghosted follow-up. No post-treatment check-in at 14 days. Automate it in Aesthetic Record or Weave.
When and how to remove a review
Google will remove reviews that reveal PHI, name a specific provider without consent, contain conflict-of-interest by a competitor, or make defamatory claims. Flag under "Restricted content" or "Off-topic" via the Google Business Profile flag tool. Response time is 3-9 business days. If the flag fails, escalate through the Google Support Business Redressal form with a written statement citing the specific policy violation. For persistent defamation, a cease-and-desist from a healthcare attorney resolves 68% of cases without litigation (BGR Review 2026 removal cohort). If none of that works, our team runs a pay-after-success removal at 449 dollars per link.
What we ship in the first 90 days
For a single-location med spa moving from 4.2 to 4.8+, the first 90 days look like this. Week 1: audit Google, RealSelf, Yelp profiles and fix NAP inconsistency. Weeks 2-3: install the 24-hour SMS ask in Aesthetic Record or Weave, train the front desk on the two-line response template. Weeks 4-8: respond to every historic review, flag PHI violations, publish 6 before-and-after case studies with signed consent. Weeks 9-12: launch a monthly reputation report to the owner, benchmark against three local competitors, and set a 4.9-star SLA for every new injector.
FAQ
Can I respond to a med spa review and confirm the patient was treated with us?
No. Confirming the patient relationship is a HIPAA disclosure under 45 CFR 164.502. Use the two-line template above and move the conversation off-platform.
Can I offer a discount for a review?
No. The 2024 FTC Fake Reviews Rule fines up to 51,744 dollars per incentivised review. Ask every patient, offer nothing.
How fast can we move from 4.2 to 4.8?
90 days is realistic for a single location with 250+ visits per month if you install the 24-hour SMS ask and respond to every review within 24 hours. Multi-location DSOs plan for 6 months.
Do fake competitor reviews get removed?
Yes, under Google's conflict-of-interest policy - but you need a written statement identifying the competitor and the policy violation. Flag first, then escalate through the Business Redressal form.
What about GLP-1 semaglutide reviews?
Never quote patient weight loss numbers in public responses - the FDA restricts off-label advertising for compounded semaglutide. Route all weight loss testimonials into private case studies with signed HIPAA and advertising consent.
Frequently Asked Questions
What are the critical platforms for med spa reputation in 2026?
The most critical platforms for med spa reputation in 2026 are Google Business Profile, RealSelf, and Yelp, especially in urban markets. Instagram also serves as a key reputation surface, driving consult bookings through tagged content. Prioritise optimising your presence and review strategy across these channels for maximum visibility and patient engagement.
How can med spas ask for reviews without violating HIPAA?
Med spas can ask for reviews by using a HIPAA-compliant platform like Weave or Podium. Send a templated SMS within 24 hours of the visit that does not mention the specific treatment or provider. The message should be general, inviting feedback on the visit, and include a link to the review platform. This avoids disclosing protected health information.
What is the safe response strategy for negative med spa reviews?
For negative reviews, respond promptly (within 24 hours) in a professional, empathetic manner without acknowledging the patient's identity or specific treatment details. Offer to resolve the issue privately via phone or direct message. Never confirm the patient-provider relationship publicly, as this constitutes a HIPAA violation. Focus on demonstrating a commitment to patient satisfaction.
How do FTC and FDA regulations impact med spa reviews?
FTC and FDA regulations significantly impact med spa reviews by prohibiting incentivised reviews (FTC) and restricting certain claims, especially for off-label treatments like GLP-1s (FDA). Violations can lead to substantial fines. Ensure your review request process is transparent and that patient testimonials do not make unsubstantiated medical claims or promote off-label uses.
Can med spas remove patient reviews that reveal PHI?
Yes, med spas can flag and request the removal of reviews that reveal Protected Health Information (PHI) or name a provider without their consent. Platforms like Google and Yelp have policies against posting sensitive personal information. Additionally, reviews violating FDA off-label advertising rules for treatments like GLP-1s can also be flagged for removal.