Med Spa Email Marketing: Three Sequences and the Opt-Out Rules Behind Them

Med spa email marketing is the use of email to recall patients for treatments they already had, reach lapsed ones, and sell seasonally, and it runs on the opposite legal default from texting: federal law lets you send a commercial email until the recipient opts out, rather than forbidding it until they opt in.

Email's default is opt-out, and texting's is opt-in

Email and SMS sit on opposite defaults. Under the CAN-SPAM Act a med spa may send a commercial email to a patient without prior permission, provided the message carries a working opt-out, a valid physical postal address and honest headers. Texting starts from the other end, where a promotional message needs consent before the first send.

The Federal Trade Commission's compliance guide sets out what the email side costs in practice, as of September 2026: header information and subject lines that are not deceptive, a clear disclosure that the message is an advertisement, the practice's valid physical postal address, an opt-out mechanism that keeps working for at least 30 days after the send, and an opt-out request honored within 10 business days.

That duty does not move when the sending does. The FTC's guide says that even if you hire another company to handle your email marketing, "you can't contract away your legal responsibility to comply with the CAN-SPAM Act." A practice whose agency owns the sending platform still owns the exposure, which is the first reason the list belongs somewhere the practice can export it.

Primary purpose decides which rules an email follows

Primary purpose is what makes an email commercial. The FTC's guide splits a message's content three ways: commercial content that advertises a product or service, transactional or relationship content that facilitates or updates a transaction the recipient already agreed to, and other content. A message made only of transactional or relationship content is not a commercial message.

That is the line a med spa crosses most often without noticing. Aftercare instructions for a treatment someone just had are relationship content. Add one line offering a discount on a return visit and the primary purpose shifts, and the same email now needs the advertisement disclosure, the postal address and the opt-out link.

The guide also reads the categories narrowly. Having a relationship with someone as a subscriber or a member does not turn a marketing message into a relationship one, so membership is no shelter for the monthly promotion that goes to members.

The three sequences that rebook, and the one that does not sell

Three email sequences carry nearly all of a med spa's rebooking revenue: post-treatment recall fired from the treatment's own interval, a lapsed-patient sequence for people past that interval, and seasonal messages tied to an event with a real date. A fourth, aftercare, belongs in the stack but is not a selling sequence.

Email's advantage over texting is room and reach. A text is one sentence to a number that gave written consent. An email carries pre-care instructions, a price range and a booking link, and it reaches every address in the practice's history that has not opted out. For a lapsed-patient sequence, that reach is the point.

Recall is where the money is. Growth99's 2026 report, published by the American Med Spa Association in January 2026, puts the average visit value at $527 and says 73% of revenue comes from repeat patients. The page does not state the survey's size or method, and the figures are cross-channel, but they say which half of a list deserves the work.

Why the open rate stopped being a number

Open rate is no longer a measurement. Apple's Mail Privacy Protection, when a Mail user turns it on, downloads a message's remote content privately in the background as the mail arrives rather than when it is viewed, hides the reader's IP address, and, in Apple's own description, keeps senders from seeing whether the message was opened.

The consequence is arithmetic. A tracking pixel fires for those readers whether or not anyone read anything, so an open rate across a mixed list is part real behavior and part automated preloading, in a proportion the practice cannot see. That makes it useless for comparing one send against another, and worse as an agency report's headline number.

What survives is anything that required a decision: clicks through to the booking page, consults booked, treatments rebooked, and the revenue behind them. A recall sequence is worth what it rebooks. Count that by treatment and over the interval the treatment actually runs on, not inside whatever calendar month the report happens to cover.

What HIPAA adds, if the practice is a covered entity

HIPAA sits on top of CAN-SPAM and is stricter. If the practice is a covered entity, 45 CFR 164.508 requires a valid authorization before protected health information is used for marketing, and that authorization has named elements: what is disclosed, by whom, to whom, for what purpose, an expiration, and the individual's signature and date.

The email-specific risk is the segment. A list split into treatment groups is a use of patient information, and a subject line naming the procedure puts it on a lock screen anyone nearby can read. The rule's only marketing exceptions are a face-to-face communication and a promotional gift of nominal value, so an email never falls inside them.

Whether a given med spa is a covered entity turns on the electronic transactions it runs, which section 164.508 does not decide. Your healthcare attorney owns that question. Until it is answered, the defensible default is segmenting by appointment timing rather than by treatment, and subject lines that name the practice rather than the procedure.

What this looks like when it runs

Lead follow-up and automation is the criterion this sits under: automated email and SMS sequences that fire from a record instead of from someone remembering. A working med spa email system is five parts: one patient record every tool reads, sequences triggered by treatment date, one suppression list, the postal address and opt-out inside the template, and a report in rebookings.

Mirastart builds that plumbing. Booking systems that calculate genuine availability and send confirmations automatically, follow-up automation that chases what people forget, and loyalty and membership software all run in production for Charlotte businesses today. An email sequence is the same machinery pointed at a treatment interval, with the unsubscribe list and the physical address treated as part of the build rather than as settings inside a vendor's tool.

On the privacy side the controls are the ones worth checking on any agency, ours included: patient information stays out of ad platforms and pixels, form submissions land in a system the practice owns, and we sign a business associate agreement where an engagement genuinely touches protected health information. The practice stays the covered entity; that does not transfer to a vendor.