Med Spa Text Message Marketing: Sort Every Message by the Consent It Needs

Med spa text message marketing is the practice of using SMS to confirm appointments, recover no-shows and sell treatments, and it splits into three legal categories before it splits into any marketing ones. Transactional, informational and marketing texts each need a different kind of consent, and the category is decided by what the message says, not by who sent it.

Three kinds of text, and only one of them needs written consent

A med spa sends three kinds of text. Transactional messages confirm or change an appointment the client booked. Informational messages tell them something without selling. Marketing messages promote a treatment, a package or an event. The Federal Communications Commission's consumer guide is blunt about the split: commercial texts need written consent, informational ones may rest on oral consent.

In the FCC's own words, on its consumer guide page as of September 2026: "Commercial texts require written consent; for informational texts, your consent may be oral." The same guide says FCC rules ban autodialed texts to a mobile phone without prior consent or an emergency purpose.

The trap is that the class is a property of the content, not of the sequence it sits in. A reminder that also says "we still have November openings for tox" is a marketing text wearing a reminder's clothes, and it needs the consent a marketing text needs.

What prior express written consent actually means

Prior express written consent, in the FCC's rule, is an agreement in writing bearing the signature of the person called, clearly authorizing the sender to deliver advertisements or telemarketing messages by autodialer or artificial voice, and naming the number those messages may go to. A booking field that captures a phone number does not do that.

So the consent lives on the intake form, not in the calendar. A separate checkbox from the treatment consent, wording that says what you will send and roughly how often, the signature and date the rule names, and the whole record stored against the phone number rather than against the client's name. The FCC's guide describes written consent as obtainable on paper or through electronic means, including website forms, so an online intake flow can carry it.

One honest limit: whether a given messaging platform counts as an automatic telephone dialing system is a question the rule text does not settle. That uncertainty argues for capturing written consent on anything promotional, not for skipping it, because the consent record is what makes the question moot.

A reply of stop is a legal event with a clock on it

Revocation is not a preference setting. Under the FCC's rule a client may revoke consent by any reasonable method, and the words stop, quit, end, revoke, opt out, cancel or unsubscribe sent in reply to a text are a reasonable means per se. The request must be honored within ten business days.

The operational failure is rarely the keyword. "Any reasonable method" also covers a client saying it in the treatment room, emailing the front desk, or replying to the wrong number — revocations that land where nobody reads them. A platform listening only for its own keyword keeps messaging someone who already opted out three other ways.

The fix is one suppression list, keyed to the phone number, that every tool reads before it sends: booking software, SMS platform, review tool, email system. Most practices run three or four of those, each with its own quiet list, which is how one opt-out becomes three continuing conversations.

What the message may say, if the practice is a covered entity

HIPAA does not ban texting patients, but it governs what a text may contain. If the practice is a covered entity, the Privacy Rule requires a valid authorization before protected health information is used for marketing, and that authorization has named elements: what is disclosed, by whom, to whom, for what purpose, an expiration, and the individual's signature and date.

Two details matter for messaging. The rule's marketing exceptions are narrow — a face-to-face communication, or a promotional gift of nominal value — and a text is neither. And a covered entity may not condition treatment on signing an authorization, which rules out bundling the marketing opt-in into the paperwork someone must sign to be seen.

Whether a particular med spa is a covered entity turns on whether it conducts standard electronic transactions, which section 164.508 does not decide. That is a question for the practice's healthcare attorney, answered before the sequences are written. The safe default meanwhile is a reminder that names the time and the practice, not the procedure.

The four sequences that earn their place

Four sequences carry nearly all the value in a med spa's messaging: the instant answer to an inquiry, the confirmation-and-reminder pair on a booked consult, the follow-up on a consult that ended without a booking, and the rebooking nudge timed to the treatment interval. Everything else competes with those four for the same finite attention.

The interval is the design input, and it is the one thing a monthly blast cannot use. Tox wears off on a schedule, so a nudge fired from the client's own last treatment date lands when the question is live. The same message sent to the whole list on the first of the month mostly does not.

That rebooking message is also the most valuable one the practice sends. Growth99's 2026 report, published by AmSpa in January 2026, says 73% of med spa revenue comes from repeat patients against an average visit value of $527 — cross-channel averages with no stated survey size or method. It is also, by content, the message most likely to count as marketing — which is why the consent record must exist before the sequence does.

What this looks like when it runs

A messaging system that holds up is five parts: consent captured at booking with its wording, signature and date stored against the number; one suppression list every tool reads before sending; templates classified by consent class before anyone writes the copy; sequences fired by appointment and treatment-interval events rather than by a calendar; and a report that puts opt-out rate next to booking rate.

Mirastart builds that plumbing. Booking systems that calculate genuine availability and send confirmations automatically, follow-up automation that chases what people forget, and loyalty and membership software all run in production for Charlotte businesses today. The messaging layer is the same machinery aimed at a treatment interval instead of a service date, with the consent record and the suppression list treated as part of the build rather than a setting inside a vendor's tool.