Med spa email and SMS marketing: consent, what to send and what to leave out

Med spa email and text marketing works when clients gave clear consent, your messages are short and useful, and you keep health details out of them. Your own list is the cheapest way to fill the book at full price. It also carries more rules than a restaurant's or a salon's, because your list can reveal what someone has had done.

This is general information, not legal advice, and the text rules are still moving. Take your forms and templates to a healthcare attorney in your state. It's about marketing only, and it makes no claim about any treatment. For claims, photos and tracking, read our compliance guide, which this builds on. We sell marketing to med spas, including email and text on some plans, so we have an interest. You can do all of this without us.

They do different jobs, and they carry different rules. Most clinics should get email right first.

The frequencies are our own rule of thumb, not a published standard. Watch your opt-outs, and send less if they climb.

Texts

The FCC has confirmed that "a text message is a 'call'" under the Telephone Consumer Protection Act (FCC). Its rules require prior express written consent for autodialed marketing, so treat any automated marketing text as needing it. That means a signed agreement, which can be electronic, that names the phone number, clearly authorizes marketing messages from you, and says that agreeing isn't a condition of buying anything.

A treatment consent form doesn't do this job. Neither does a phone number on an intake form. Use a separate box, unticked, with wording like this, and have your attorney adapt it:

Consent has limits. Twilio's policy says consent covers only the subject the person agreed to, that it can't be bought or transferred, and that you should keep proof (Twilio). So don't text someone who agreed to appointment reminders with a promotion. If you bought a list, or inherited one from a clinic you acquired, don't text it until you've taken advice.

Email

Under the CAN-SPAM Act, the FTC's guide focuses on honest identification and a working opt-out rather than prior consent (FTC). We'd still ask, with its own box. People who asked to hear from you read more of it, and HIPAA may need more from you anyway (see below).

The FTC's guide covers commercial email from any business. Your email tool handles some of it, but the FTC says "you can't contract away your legal responsibility", so an agency sending on your behalf doesn't move it off your clinic:

The FTC says each separate email in violation can bring penalties of up to $53,088 (FTC).

Here's the short version as of October 2026. Your provider should help with the mechanics, and your attorney should check the rest.

• Honor opt-outs fast. The rule says a reasonable time, up to ten business days, and treats replies like "stop" as a valid way to opt out. You can't insist on one method only for texts (47 CFR 64.1200).
• Watch one date. Part of that rule, which would make one opt-out apply to all your calls and texts on unrelated matters, is waived until January 31, 2027 (InfoLawGroup, on the FCC's order). Check before then. If your tool can treat a STOP as stopping everything, that's the simplest way to be ready.
• Send between 8 a.m. and 9 p.m. in the client's time. The time-of-day rule covers telephone solicitations. One law firm review from March 2026 argues it doesn't reach consented texts, and says courts are split on how some of these rules apply to texts. Whatever the outcome, no one wants a med spa text at midnight.
• Register your sending number. Twilio says anyone sending over a standard business number (10DLC) to the US from an application must register, and that unregistered traffic pays extra carrier fees (Twilio). Ask your booking software if it handles this.

Prescription products in texts: a carrier problem

This one catches med spas out. Twilio says carrier policies and CTIA guidelines prohibit texting campaigns that promote prescription drugs, and that a campaign rejected on those grounds can't be resubmitted (Twilio). Our compliance guide notes that some injectables are prescription drugs. So a text promoting one by name may be blocked, whatever your consent records look like. It's another reason to leave product names out of promotional texts. Ask your provider how it treats your category before you build a campaign around one.

State rules: Texas as an example

State laws can go further than federal ones, so check yours. The American Med Spa Association warns that Texas's SB 140, in effect since September 1, 2025, may affect med spas that send marketing texts to people in Texas, or from it. Registering involves a $200 filing fee and a $10,000 security bond, and the law has exemptions, including for soliciting current or former customers, that aren't automatic (AmSpa). Morgan Lewis says failing to register is a class A misdemeanor, and that some exemption terms are undefined (Morgan Lewis). If you text cold prospects in Texas, or aren't sure, ask your attorney.

First, find out if it applies. A provider is a covered entity if it transmits health information electronically in connection with a covered transaction (45 CFR 160.103), which is why some cash-only clinics may not be. Our compliance guide explains that question. Your attorney should decide it and write it down. If you aren't covered, state privacy laws may still apply, and clients expect discretion either way.

If you are covered, three things change:

• Marketing needs an authorization. HIPAA defines marketing as a communication that encourages people to buy or use a product or service, and generally requires an authorization to use protected health information for it (45 CFR 164.501, 164.508). There are exceptions, including some treatment communications, but whether a given reminder fits one is a question for your attorney.
• Your tools may be business associates. A company that creates, receives, maintains or transmits protected health information for you is a business associate, and that arrangement must be in a written contract. Ask each email and text vendor whether it'll sign one. Some may not, so ask before you upload anything.
• Your list itself can say too much. A segment called "filler clients" links a name to a treatment. So does a campaign that goes only to people who had a procedure.

The safe habit holds whatever your HIPAA status: keep health details out of marketing tools. Your email or text tool needs a first name, contact details and a reminder date. It doesn't need a treatment history. Let your booking software work out who's due, and pass only a generic "due for a visit" flag.

Set up the first three once, and they'll run by themselves. They suit a clinic best, because they follow each client's own schedule.

A few examples, to change into your own words, and to run past your medical director:

Welcome (email): "Thanks for joining the Willow Med Spa list. You'll hear from us about twice a month: new providers, events and member news. Update your preferences at any time."

Rebooking (text): "Hi Dana, it's Willow Med Spa. It may be time to book your next visit. Book here: [link]. Reply STOP to opt out."

Lapsed client (email): "It's been a while, Dana. Dr. Reyes now sees clients on Saturdays, and we'd love to see you. Book here, or call us with any questions."

Event (email): "Join us for a provider Q&A on the 14th. Bring your questions, with no obligation. Reply to save a seat."

None of those name a treatment, and none promises a result. That's deliberate. On a lock screen, "time for your next filler" tells anyone nearby something private. Our pillar guide makes the same point about reminders.

What to leave out

• Treatment names on a lock screen, unless the client has agreed.
• Any promise about results, safety or downtime. Our compliance guide has the wording to check with your medical director.
• Brand names on anything that isn't that brand. The same guide covers compounded drugs.
• Before-and-after photos without written authorization.
• Constant discounts. They teach clients to wait. Read full-price bookings vs discount deals first.
• Health questions by text. Move those to a call or a secure portal.

Start with your booking software, since it knows who's due. Our software guide compares what the main ones include. Before you sign, or before you add a separate email tool, ask: Will you sign a business associate agreement if we need one? Who owns the client list, and can we export it? Does it record consent, and does STOP work automatically? Is our sending number registered? If an agency runs it, ask the same questions, and get the answers in writing.

Count bookings, not opens. Give each message its own link, then see what it brought in. Here's the arithmetic for one rebooking message, with example numbers to replace with your own:

We couldn't find a reliable open-rate or rebooking benchmark for med spas, so compare your numbers with your own last quarter. Also watch your opt-outs per message. If a message loses more people than it books, rewrite it or stop it.

Pull up your intake form, and look at what clients actually agree to. Ask your attorney to confirm whether HIPAA applies and to check your consent wording. Export a sample of your email tool's contacts and look for treatment names, tags or segments that shouldn't be there. Then write the welcome and rebooking messages, have your medical director approve them and turn them on. For where this fits in with everything else, read our med spa marketing guide.