How to Get Med Spa Reviews Without Breaking Three Sets of Rules

A med spa review engine is a fixed process (same ask, same script, same reply standard), and all three steps are now governed: the FTC's consumer reviews rule, each platform's solicitation policy, and HIPAA, under which a covered entity's reply naming a patient's treatment is a disclosure of protected health information. This is marketing guidance, not legal or medical advice.

The ask is regulated now, and it was not always

The habits most spas learned - the survey that filters out unhappy clients, the ten dollars off for a five-star, the front desk asking only the patients who hugged them on the way out - date from a period when the enforcement risk was theoretical. That period ended. The FTC's Rule on the Use of Consumer Reviews and Testimonials, 16 CFR Part 465, took effect on October 21, 2024, and it is a rule rather than a guideline, which means violations can carry civil penalties. It names fake and insider reviews, compensation tied to the sentiment of a review, and the suppression of negative ones as prohibited practices. Read the current text on the eCFR and the FTC's summary at ftc.gov before writing your review policy - what follows is the shape of it, not a substitute.

The ask is a front-desk process, not a campaign

Every reliable review engine has the same three properties: the same person asks, at the same moment, in the same words. That is not a stylistic preference. Consistency is what makes the ask defensible - if you ask everyone the same way, you cannot be selectively soliciting, and the question of who you asked never comes up.

The moment matters more than the wording. For a med spa, the natural window is the visit where the patient can already see the result - the two-week tox follow-up, not the day of injection, and certainly not a bulk email six months later. The ask should end with a link on their phone before they leave the building, because a review that requires the patient to go find you on Google later mostly does not happen. A short link texted from the front desk while they are checking out converts far better than any email sequence, and it is the same ask every time.

Who asks is the other half. The front desk at checkout is the right place - neutral, routine, and not the person who just held the needle. A provider asking inside a clinical interaction puts the patient in an awkward position and blurs a line worth keeping clean.

Sentiment gating is the shortcut that gets caught

Gating is the funnel where every patient gets a satisfaction survey, the ones who answer positively get the Google link, and the ones who answer negatively get a private feedback form. Software vendors have sold this pattern for years as reputation management. It is worth being precise about why it is a problem, because the two rules that bite here bite differently.

Google's Business Profile content policy is the direct one: it prohibits discouraging or prohibiting negative reviews and selectively soliciting positive ones. That is a platform rule with platform consequences - review removal, and profile-level trouble for repeat patterns. The FTC angle is narrower but heavier. Section 465.6 addresses review suppression, including unfounded legal threats or intimidation used to remove reviews, and misrepresenting that the reviews you display are all the reviews submitted when negative ones have been withheld. So the funnel itself is a platform violation, and the moment the curated result is presented as your honest reputation, it becomes a deception question too. Ask everyone. The average of everyone is a number you can live with, and a perfect five across two hundred reviews reads as manufactured to buyers who have learned to look.

What you may and may not offer

This is where the honest answer disappoints people. Under 16 CFR §465.4, providing compensation or another incentive conditioned on a review expressing a particular sentiment is prohibited - so a discount for a five-star is out, and so is the softer version where staff mention the reward only to patients who seemed pleased. An incentive offered to everyone regardless of what they write is not squarely that provision, but it is not clean either: the FTC's Endorsement Guides at 16 CFR Part 255 require clear disclosure of a material connection between a business and a reviewer, which means the patient has to say in the review that they got something, and Google's policies treat incentivized reviews as prohibited content on their own terms. The practical position for a med spa is to offer nothing. A review you paid for is worth less than one you did not, in every sense including the ranking one.

Staff reviews are the other tempting shortcut. Section 465.5 covers insider reviews - reviews by officers, managers, or employees, and those solicited from their immediate relatives - and requires clear and conspicuous disclosure of the relationship. A disclosed employee review is close to worthless as social proof, which makes the compliance question academic: do not do it.

The reply is where med spas actually get penalized

Every other item on this page is a marketing risk. This one is an enforcement record. The HHS Office for Civil Rights has taken action against practices that disclosed patient information while responding to online reviews: a 2019 settlement with Elite Dental Associates over Yelp responses that revealed patient details, and a $50,000 civil money penalty announced in March 2022 against a Charlotte-area dental practice that named a patient and described their visit in a reply to a negative Google review. Both are published on hhs.gov, and the fact pattern is the same one a med spa walks into every time an owner responds to an unfair review by explaining what actually happened at the appointment.

The rule that avoids it is simple and absolute: a public reply never confirms that the reviewer is a patient, never names a treatment, never corrects their version of events with clinical facts. Not even when they lied. Not even when they named the treatment themselves in their own review - their disclosure is theirs to make, and yours is still a disclosure.

What is left is still a good reply, because the audience was never the reviewer. It is the next person reading, and what they are assessing is whether this business is calm. A workable template for a negative review: thank them for the feedback, state a standard the practice holds itself to, and give one route to a private conversation with a named role. "We appreciate you taking the time to share this. We hold ourselves to a high standard for every visit, and we would like to understand what happened - please contact our practice manager at [number] so we can talk directly." That is it. No details, no defense, no history.

The negative review you should not try to remove

Platforms will remove reviews that violate their policies - fake reviews, off-topic content, reviews from competitors, personal attacks - and flagging those is legitimate. What does not work, and now carries specific risk, is pressuring a real patient with a real complaint into taking their review down. Unfounded legal threats aimed at removing a review are named conduct in the FTC rule, and a demand letter that ends up screenshotted is its own marketing event.

A small number of negative reviews is also load-bearing: they are what makes the positive ones believable to someone about to let a stranger inject their face. The only durable response to a bad review is the next twenty good ones.

Steady beats spiky

Google's own guidance on improving your local ranking states that review count and score factor into local search ranking - the closest thing to a primary source here, and worth reading directly rather than through a vendor's summary. What it does not spell out, and what practitioners consistently observe, is that pattern matters as much as volume: a handful arriving every month reads as an operating business, while forty in one week after eleven months of silence reads as a campaign. Build for a cadence you can hold when the front desk is short-staffed.

The engine, end to end

1. 1Write one ask, in your own words, and put it on a card at the checkout desk so every team member says the same thing.
2. 2Pick the moment per treatment - typically the follow-up visit where the result is visible - and make it a step in the checkout flow rather than a memory test.
3. 3Send the link by text while the patient is still there, straight to your Google review form, no landing page in between.
4. 4Ask everyone. No survey filter, no sentiment routing, no incentive of any kind.
5. 5Reply to every review within a couple of business days, using a reply standard that never confirms treatment or patient status.
6. 6Route negatives to one named person for a private conversation, and keep the public reply to three sentences.
7. 7Check monthly: how many asks, how many reviews, and whether the flow is steady - not whether the average went up.