A med spa's Google Business Profile is the page that decides most high-intent local searches, and it is usually the most neglected asset a spa owns: a rushed primary category, an empty Services section, stale photos and description. This field-by-field pass, current as of August 2026, is operational guidance, not legal or medical advice; your medical director and counsel own the compliance calls.
The primary category is the single biggest lever
Google's category list is what makes you eligible to appear for a query at all, and the primary category carries far more weight than the additional ones. The list contains several plausible options for an aesthetics business - Medical spa, Skin care clinic, Day spa, Facial spa, Laser hair removal service, Wellness center - and they are not interchangeable. A spa whose revenue is injectables and lasers but whose primary category reads Day spa is competing against massage and facials for relevance, and losing the searches it actually wants. Set the primary category to the thing you most want to be found for and that honestly describes the practice, then add the additional categories that reflect real services. Additional categories widen eligibility; they do not repair a wrong primary.
The Services section is the part almost nobody fills in
Under each category, Google lets you list services - including custom ones you type yourself - with a description on each. Most med spa profiles have either nothing here or the three Google pre-filled automatically. This is free, structured, first-party text about exactly what you sell, sitting on the surface Google reads first. Every treatment on your menu belongs here with a real description: what it treats, roughly how long a visit runs, who performs it. Two disciplines make it worth the hour: match the wording to what patients actually type (people search 'lip filler' more than 'dermal filler augmentation'), and keep it honest - listing a service you do not currently offer is the kind of mismatch that generates a one-star review before it generates a booking.
Photos, and the one kind that creates a compliance problem
Photos are the cheapest ongoing signal on the profile and the one most spas stop maintaining after opening week. Upload the real thing: exterior with the signage a patient will look for from the parking lot, the entrance, the treatment rooms, the team. Stock imagery of a woman in a towel tells a buyer nothing and reads as a business that has something to hide. Then keep a cadence - a few new images a month beats a single dated batch.
The exception is patient imagery. Before-and-after photos are the most persuasive asset a spa owns and the fastest way to turn a marketing asset into a compliance incident: an identifiable patient image published in advertising needs a signed authorization that actually covers this use, and if your practice is a HIPAA covered entity, a general consent-to-treat form is not that authorization. The safe default for the profile itself is facility, team, and equipment photography, with before-and-after content handled deliberately elsewhere under a documented authorization process. The same logic applies to review replies - the HHS Office for Civil Rights has settled enforcement actions against practices that disclosed patient information while responding to online reviews, so a reply should thank the reviewer without ever confirming that they were treated or what for.
The fields most med spa profiles leave blank
| Field | What most med spa profiles have | What it should have |
|---|---|---|
| Primary category | Day spa or Skin care clinic by default | The category matching your actual revenue mix |
| Services | Empty, or Google's auto-suggestions | Every treatment, custom-named, with a real description |
| Business description | A paragraph from the 2022 website | Current menu, who performs treatments, service area |
| Appointment link | Blank, or pointed at the homepage | The booking page itself, one click from the tap |
| Attributes | Untouched | Appointment required, online booking, accessibility, ownership |
| Photos | Buildout photos and stock | Current space, team, equipment - refreshed monthly |
| Q&A | Whatever a stranger asked in 2023 | Owner-posted answers to the questions consults always start with |
| Hours | Set once, never adjusted | Accurate, with holiday and special hours entered ahead |
Messaging and Q&A are patient-facing surfaces
Two features on the profile behave less like marketing settings and more like intake channels. Google's Q&A is open to the public - anyone can post a question and anyone can answer it, which means a competitor or a confused stranger can be the voice answering 'do they do PDO threads?' unless you have posted and answered the obvious questions yourself. Do that deliberately: the five questions every consult opens with, answered plainly, in your words.
Profile messaging is the sharper one. Turn it on and patients will describe conditions, ask whether a treatment is appropriate for them, and send photographs, all in a channel your practice does not control and cannot easily archive into a chart. Either staff it with a written rule about what gets answered there - scheduling and general information yes, clinical questions moved to a phone call or your intake system, no - or leave it off. An unmonitored message channel with a slow response time is worse than no channel at all, because Google shows the responsiveness.
What actually gets a med spa profile suspended
A suspended profile disappears from the map at the exact moment it was earning, and reinstatement runs on Google's timeline rather than yours. The triggers are predictable, and Google's published guidelines for representing your business name most of them outright. Keywords packed into the business name field - 'Charlotte Med Spa | Botox & Filler' when the door says something else - is the most common one and among the easiest to trip. So is an address that does not resolve to a staffed, patient-facing location: a virtual office, a co-working mailbox, a suite number invented to look distinct. If your spa has treatment rooms, it is a storefront and the address belongs on the profile; hiding it behind a service-area setting throws away the proximity signal the map pack runs on.
One legitimate exception is worth knowing: Google's guidelines allow a public-facing individual practitioner - a physician, PA, or nurse practitioner who is themselves a reason patients choose you - to hold a profile in their own name alongside the practice's. That is a real opportunity for an injector with a personal following. It is also a duplicate-listing violation if used to create a second bite at the same business under a keyword-shaped name.
The 90-minute pass, in order
- 1Confirm the primary category matches your revenue mix, then add every honest additional category.
- 2Type out every treatment in Services, with a description on each, using patient wording.
- 3Rewrite the business description against the current menu, staffing, and service area.
- 4Point the appointment link at the booking page - not the homepage - and test it on a phone.
- 5Set every applicable attribute, including appointment-required and accessibility.
- 6Upload a current photo set: exterior, entrance, treatment rooms, team. Diary a monthly refresh.
- 7Post and answer the five questions every consult starts with in Q&A.
- 8Decide, in writing, whether messaging is on and who answers it within what window.
- 9Enter holiday and special hours for the next quarter while you are already in there.
Sources
- Google Business Profile Help, Guidelines for representing your business on Google - Business name, address eligibility, categories, and individual-practitioner rules.
- Google Business Profile Help, Manage your services on your Business Profile
- HHS Office for Civil Rights, settlement with New Vision Dental over PHI disclosed in responses to online reviews (December 2022) - $23,000 settlement plus a corrective action plan.
- 45 CFR 164.508, authorization required for marketing uses of protected health information (Cornell LII)