How to Get Med Spa Reviews Without Breaking Three Sets of Rules

A med spa review engine is a fixed process (same ask, same script, same reply standard), and all three steps are now governed: the FTC's consumer reviews rule, each platform's solicitation policy, and HIPAA, under which a covered entity's reply naming a patient's treatment is a disclosure of protected health information. This is marketing guidance, not legal or medical advice.

The ask is regulated now, and it was not always

The FTC's Rule on the Use of Consumer Reviews and Testimonials, 16 CFR Part 465, took effect on October 21, 2024, and it is a rule rather than a guideline: knowing violations can carry civil penalties. It names fake and insider reviews, compensation tied to a review's sentiment, and the suppression of negative reviews as prohibited practices.

The habits most spas learned date from a period when the enforcement risk was theoretical: the survey that filters out unhappy clients, the discount for a five-star, the front desk asking only the patients who hugged them on the way out. That period ended in October 2024. Read the current text on the eCFR and the FTC's summary at ftc.gov before writing your review policy; what follows is the shape of the rule, not a substitute for it.

The ask is a front-desk process, not a campaign

Every reliable review engine has the same three properties: the same person asks, at the same moment, in the same words. That is not a stylistic preference. Consistency is what makes the ask defensible - if you ask everyone the same way, you cannot be selectively soliciting, and the question of who you asked never comes up.

The moment matters more than the wording. For a med spa the natural window is the visit where the patient can already see the result: the two-week tox follow-up, not the day of injection, and never a bulk email six months later. The ask ends with a link on the patient's phone before they leave the building, sent by text from the front desk at checkout, because a review that requires them to find you on Google later mostly does not happen.

Who asks is the other half. The front desk at checkout is the right place: neutral, routine, and not the person who just held the needle. A provider asking inside a clinical interaction puts the patient in an awkward position and blurs a line worth keeping clean, so the ask belongs to the desk, on a card, in the same words every time.

Sentiment gating is the shortcut that gets caught

Gating is the funnel where every patient gets a satisfaction survey, the ones who answer positively get the Google link, and the ones who answer negatively get a private feedback form. Software vendors have sold this pattern for years as reputation management. It is worth being precise about why it is a problem, because the two rules that bite here bite differently.

Google's Business Profile content policy, as of August 2026, is the direct rule: it prohibits discouraging or prohibiting negative reviews and selectively soliciting positive ones. That is a platform rule with platform consequences, review removal and profile-level trouble for repeat patterns. The FTC angle is narrower but heavier. Section 465.7 names review suppression, including unfounded legal threats or intimidation used to remove a review, and misrepresenting that the reviews you display are all the reviews submitted when negative ones have been withheld.

So the funnel itself is a platform violation, and the moment the curated result is presented as your honest reputation it becomes a deception question too. Ask everyone. The average of everyone is a number you can live with, and a perfect five across two hundred reviews reads as manufactured to buyers who have learned to look.

What you may and may not offer

Incentives for reviews are the honest answer that disappoints people: offer nothing. Under 16 CFR §465.4, compensation or any other incentive conditioned on a review expressing a particular sentiment is prohibited, so a discount for a five-star is out, and so is the softer version where staff mention the reward only to patients who seemed pleased.

An incentive offered to everyone regardless of what they write is not squarely that provision, but it is not clean either. The FTC's Endorsement Guides at 16 CFR Part 255 require clear disclosure of a material connection between a business and a reviewer, and the FTC's staff FAQ on the Endorsement Guides puts it plainly, as of September 2026: "Even an incentive with no financial value might affect the weight or credibility of an endorsement and would need to be disclosed."

Google's policies treat incentivized reviews as prohibited content on their own terms, as of August 2026, and a review you paid for is worth less than one you did not, to the buyers a med spa wants most.

Staff reviews are the other tempting shortcut, and the rule treats them as insider reviews. Section 465.5 covers reviews by a business's officers, managers or employees, and reviews solicited from their immediate relatives, and requires clear and conspicuous disclosure of the relationship. A disclosed employee review is close to worthless as social proof, which makes the compliance question academic: do not do it.

The reply is where med spas actually get penalized

The reply is the one step with an enforcement record rather than a marketing risk. The HHS Office for Civil Rights has taken action against practices that disclosed patient information while responding to online reviews, and the fact pattern is the one a med spa owner walks into when a reply explains what happened at the appointment.

Both cases are published on hhs.gov. A 2019 settlement with Elite Dental Associates followed Yelp responses that revealed patient details, and a $50,000 civil money penalty announced in March 2022 went to a Charlotte-area dental practice that named a patient and described their visit in a reply to a negative Google review.

The reply standard is simple and absolute: a public reply never confirms that the reviewer is a patient, never names a treatment, and never corrects their version of events with clinical facts. Not even when they lied. Not even when they named the treatment themselves in their own review, because their disclosure is theirs to make and yours is still a disclosure.

What is left is still a good reply, because the audience was never the reviewer. The audience is the next person reading, and what they are assessing is whether this business is calm. A workable template for a negative review has three parts: thank them for the feedback, state a standard the practice holds itself to, and give one route to a private conversation with a named role.

In practice the whole reply reads: "We appreciate you taking the time to share this. We hold ourselves to a high standard for every visit, and we would like to understand what happened. Please contact our practice manager at [number] so we can talk directly." That is it. No details, no defense, no history.

The negative review you should not try to remove

The negative review you should not try to remove is a real patient's real complaint. Platforms will remove reviews that violate their policies, such as fake reviews, off-topic content, reviews from competitors and personal attacks, and flagging those is legitimate. Pressuring a real patient into taking a review down is different: unfounded legal threats aimed at removing a review are named conduct in the FTC rule, and a demand letter that ends up screenshotted is its own marketing event.

A small number of negative reviews is also load-bearing: they are what makes the positive ones believable to someone about to let a stranger inject their face. The only durable response to a bad review is the next twenty good ones.

Steady beats spiky

Steady beats spiky: a handful of reviews arriving every month reads as an operating business, while forty in one week after eleven months of silence reads as a campaign. Google's own guidance on improving your local ranking, as of September 2026, says more reviews and positive ratings can help a business's local ranking.

Google's page is the closest thing to a primary source here, worth reading directly rather than through a vendor's summary. What it does not spell out, and what practitioners consistently observe, is that pattern matters as much as volume. Build for a cadence you can hold when the front desk is short-staffed.

The engine, end to end

A med spa review engine is seven steps that run the same way at every checkout, and the automated SMS sequence that sends the link is the one a front desk cannot keep by memory. Fast, automated SMS and email sequences for review requests run in production for Charlotte businesses; the seven steps below are what that sequence executes.

1. 1Write one ask in your own words and put it on a card at the checkout desk, so every team member says the same thing.
2. 2Pick the moment per treatment, typically the follow-up visit where the result is visible, and make it a checkout step rather than a memory test.
3. 3Send the link by text while the patient is still in the building, straight to your Google review form, with no landing page in between.
4. 4Ask everyone: no survey filter, no sentiment routing, and no incentive of any kind, because a uniform ask is the version both rulebooks allow.
5. 5Reply to every review within two business days, using a reply standard that never confirms treatment or patient status.
6. 6Route negative reviews to one named person for a private conversation, and keep the public reply to three sentences.
7. 7Check monthly: how many asks went out, how many reviews came in, and whether the flow is steady, not whether the average went up.