Med Spa Business Software: Complete Guide to Clinical, Retail, and Marketing Operations

A med spa is three businesses sharing a front desk. Fifty percent medical — Botox units measured to the dose, filler tracked by syringe and lot number, laser series counted across appointments, eConsent that has to hold up if a treatment goes sideways, before-and-after photos that live next to PHI. Fifty percent retail — skincare on the shelves, packages and gift cards moving through the POS, memberships that bank credits and roll over, loyalty points from Allē and Aspire applied at checkout. And one hundred percent marketing-driven — Instagram and TikTok bring the leads, retargeting closes the consult, automated reactivation wins back the dormant clients, and reviews are the difference between a fully booked Saturday and a quiet one.

Most software handles one of those cleanly and forces the other two into workarounds. The front desk reconciles two systems at end of day. Photos sit in one tool, charts in another, consents on paper. Membership balances are a spreadsheet because the booking platform does not actually track banked services. Marketing campaigns fire from a separate tool that does not know which client just spent $1,800 on a filler package and should not be in the discount blast. This guide walks through what a med spa actually needs in 2026 to run cleanly across clinical, retail, and marketing — workflows, software categories, KPIs, the compliance terrain, and the specific places where most operators leak revenue.

The cleanest way to understand a med spa software stack is to walk a single patient through a single visit and notice every place the system has to hand off. The visit starts before the patient arrives — they booked through Instagram, picked a 60-minute slot for filler with their preferred injector, paid a $100 deposit through the booking flow, and received an SMS pre-visit checklist (avoid blood thinners 48 hours, arrive 15 minutes early, no makeup on the treatment area). Twenty-four hours out, the booking platform sent a confirmation; two hours out, a final reminder. The deposit is held against the appointment.

Check-in (5 minutes): The front desk pulls up the chart. Last visit notes, photos from the last filler appointment, current package balance (3 of 6 sessions remaining on a Botox series), allergies, current meds. The patient confirms updates on a tablet, signs the eConsent for today's specific treatment, and gets routed to the room. The eConsent is treatment-specific (which product, which areas, the risks particular to that filler in that location) and the signed PDF is filed against the chart automatically.

Pre-treatment photos (3 minutes): The injector takes a standardized set — front, three-quarter, profile, both sides — under consistent lighting. Photos save directly into the patient record, encrypted, and pre-tag with the date, treatment type, and product so the comparison view will pull them later.

Treatment (35 minutes): The injector documents Botox units per area or filler syringes per zone in the chart, with the product lot number captured automatically from the inventory system. The package balance decrements by the units used. If the patient bought a series of 6, this is session 4.

Post-treatment + retail cross-sell (10 minutes): The injector recommends a specific aftercare product — a peptide serum tied to the treatment notes — and the system flags it for the front desk. The patient gets post-care SMS instructions automatically. Post-treatment photos are taken and tagged.

Checkout (5 minutes): The front desk applies the deposit, charges any balance, sells the recommended skincare, applies loyalty points, and books the next appointment — recall logic suggests 12 weeks for Botox, 9 months for the next filler touch-up. Today's visit is now closed in the chart, the package balance is updated, the retail sale is attached to the patient record, the membership program credits are applied, and a post-visit review request is queued for 48 hours from now.

That is twelve discrete software events in one 60-minute visit. A med spa stack that handles all twelve in one workspace is fundamentally different from one that handles them across booking, charting, photo, POS, marketing, and membership tools. The integration tax is paid every visit, every day.

Each treatment family has its own protocol, supply chain, and documentation rhythm, and good med spa software treats them as distinct rather than forcing one generic 'service' template across all of them.

Botox / neurotoxins: Documented in units per anatomic area (glabellar, frontalis, crow's feet, masseter). Lot number and expiration captured per dose. Treatment plan tracks total units delivered across visits and flags when a patient is approaching dilution or tachyphylaxis territory. Series billing is rare — most patients pay per visit — but membership programs (Alle, Aspire, in-house) discount the per-unit rate.

Dermal fillers: Documented in syringes (or fractions) per zone (lips, NLF, marionette, cheek, jawline, temple, chin). Product (Juvederm, Restylane, RHA, Versa) captured by name and lot. Filler tends to be sold as packages or treatment plans across multiple visits — for example, a 'full face' plan delivered across 2-3 sessions. Photography is more important here than for Botox: cheek and jaw projection are visually subtle, and side-by-side comparisons protect the practice if a patient questions the result months later.

Laser (IPL, BBL, picosecond, fractional CO2, vascular, hair removal): Almost always sold as a series — 3, 4, 6, or 8 sessions depending on the modality and indication. Charting captures device settings (fluence, pulse width, spot size, cooling) per pass per area. Settings carry forward visit to visit so the next session can reproduce or adjust. Pre/post photos are essential for tone and texture work. Hair removal in particular is a series-billed, package-priced category where the platform must track sessions consumed, sessions remaining, and the per-session value used in revenue recognition.

IV therapy / wellness drips: Increasingly part of the med spa menu (NAD+, Myers' cocktail, glutathione, hydration). Different supply chain (compounding pharmacy, ambulatory infusion supplies) and different chart structure (vitals before and after, drip rate, total volume, time on the chair). Membership programs are common — the 'monthly drip' subscription is one of the highest-LTV offerings in the category.

A platform that captures all four in one charting system, with photo and inventory tied through, is the operational backbone. A platform that handles only the beauty-side workflow forces the medical complexity into notes fields and external spreadsheets, which is where revenue and compliance both leak.

Before-and-after photos do three jobs simultaneously: clinical evidence, marketing asset, and patient retention tool. Each job has different requirements, and the platforms that get this right treat photos as a first-class part of the chart rather than an upload field.

Clinical evidence: Photos must be standardized (same lighting, angle, distance, framing) so the comparison is honest. Most clinical disagreements between patient and practice are settled by the photo, not by the note. Date-stamped, encrypted at rest, audit-logged. PHI by definition.

Marketing asset: With explicit, separately-signed photo release, before-and-afters become Instagram, website gallery, and consult-room sales tools. The platforms that handle this cleanly track three consent levels: chart-only (clinical use), website/social with face visible, and 'cropped only' (treatment area only, no identifying features). The release is per-photo or per-treatment, not blanket.

Retention tool: A patient looking at their own pre-treatment photo six months in is a patient who renews the package. The comparison view — yours, then yours, then yours — is the most powerful single screen in the whole platform.

The key software capability is a comparison view that lets the injector pull up two timepoints side by side, lock the orientation and crop, and walk the patient through the change. AI-assisted photo standardization (auto-aligning angle and framing from one visit to the next) is now table-stakes for the leading platforms. Storage is encrypted, role-permissioned, and segregated from any third-party cloud where possible — a leaked before-and-after with a face attached is a HIPAA breach, a state board complaint, and a marketing crisis at the same time.

A treatment plan is the agreement between the patient and the practice for what will be delivered over a series of visits. A package is the financial wrapper around it. Most med spas under-build both.

Treatment plan structure: A laser hair removal series for the bikini area is six sessions spaced 4-6 weeks apart at $300 per session. The plan defines the modality, the area, the device settings, the spacing, and the expected outcome. The patient signs the plan once. Each visit consumes one session, and the platform tracks sessions delivered and remaining. If the patient pauses for three months, the plan should not auto-cancel — but the recall workflow should re-engage them.

Package pricing: The same six-session series sold as a package is $1,500 — a 17% discount for paying upfront. Revenue is recognized per session (deferred revenue accounting), not at point of sale. This matters for cash flow forecasting and for refunds (if the patient cancels at session 3, the refund is calculated against three remaining sessions, not against a flat half of the package price).

Bundles and gift cards: Bundles cross-sell — 'Glow Package' includes 3 HydraFacials and a peptide serum at a 15% discount. Gift cards are bearer instruments and need to be tracked separately from packages (the gift card can be redeemed for anything; the package can only be redeemed for what was sold).

Membership banking: Membership programs that 'bank' a monthly credit (e.g., $99/mo includes one HydraFacial, with unused credits rolling for 90 days) are a category-leading retention mechanic. The software has to track the credit balance, expiration windows, and what services it can be applied to. Spreadsheet membership tracking is the single most common operational hole in independent med spas; it leaks 5-15% of membership revenue annually to lost balances, miscredits, and reconciliation errors.

Retail attach rate — the percentage of treatment visits that result in a retail product sale — is one of the cleanest financial signals in a med spa. Strong med spas run a 35-55% attach rate. Weak med spas run sub-15%. The difference is almost always operational, not motivational. The injector recommends a peptide serum based on the treatment notes; the front desk needs to see that recommendation when the patient checks out, or the recommendation evaporates between the room and the till.

The operational requirement: skincare lines (SkinCeuticals, Skinbetter, ZO, Alastin, Obagi, EltaMD, Revision, Colorescience) live in the same POS as treatments, with the same patient record, the same loyalty program, and the same returns/exchange workflow. A retail purchase tied to a treatment note is a retail purchase that gets reordered (the platform can predict when the patient is running out and prompt a reorder SMS). A retail purchase that lives in a separate Square account is a one-time transaction.

Retail margin reality: Skincare retail margins run 35-55% depending on the line and the practice's purchase volume. A med spa hitting $100K/month in treatment revenue and a 45% retail attach rate at $80 average ticket adds roughly $30K/month in retail revenue at 45% margin — about $13.5K of additional gross profit, with no additional clinical labor. That is the single highest-ROI operational lever in the business, and it is operational software, not marketing, that controls it.

Two categories of program drive med spa retention, and they overlap.

Manufacturer loyalty (Allē, Aspire, Galderma Rewards): Allergan's Allē (formerly Brilliant Distinctions) credits patients for Botox, Juvederm, CoolSculpting, SkinMedica, and Latisse. Galderma's Aspire credits Dysport, Restylane, and Sculptra. These programs are non-negotiable — patients expect the points, ask for them at checkout, and switch practices over them. The platform has to enroll patients, capture the receipt at point of sale, sync redemptions, and apply rewards on the next visit. Manual entry of these is one of the most reliably forgotten front-desk tasks; native integrations are worth real money.

Custom membership tiers: In-house memberships ($99-$299/mo typically) include a banked monthly service plus a percentage discount on everything else. Three-tier structures are most common: an entry tier ('Glow' — one HydraFacial monthly), a mid tier ('Elite' — one HydraFacial plus 10 units of Botox quarterly), and a premium tier ('Concierge' — quarterly filler credit plus monthly facial plus 15% off everything). Members spend 2-3x more per year than non-members and have 70-85% annual retention versus 35-55% for non-members.

The software requirement: recurring billing (Stripe-grade), banked credit tracking with rollover rules and expiration, member-only pricing applied automatically at checkout, member-only booking access for premium hours, and reporting on member churn, ARPU, and LTV. Most general-purpose booking platforms handle the recurring billing piece but not the banked credit logic, which is where memberships either work or quietly fall apart.

Med spa demand is overwhelmingly social-led. Instagram and TikTok produce 40-65% of new-patient leads at most independent practices in 2026, with Google search second (15-25%) and direct referral third (10-20%). The marketing stack has to handle four motions: lead capture, retargeting, post-visit engagement, and dormant client win-back.

Lead capture: Instagram and TikTok bookings flow either through a link-in-bio booking tool, a Meta lead form that pushes into the CRM, or a DM-to-booking conversation. The booked appointment is attributed to the source so marketing ROI is measurable. Practices that cannot tell you which platform produced last month's bookings are flying blind.

Retargeting: Patients who consult but do not book within 7 days are the highest-value retargeting audience the practice has. Pixel-based Meta retargeting plus an email/SMS nurture sequence (consult summary, before-and-afters relevant to the treatment they discussed, financing options) typically converts an additional 15-25% of consults that would otherwise have walked.

Post-visit engagement: Review requests fire 48 hours after visit (Google reviews convert highest in this window), aftercare reminders fire on day 3 and day 7, retail reorder prompts fire 60-75% of the way through the typical use cycle of the product sold. Birthday and anniversary offers convert at 25-40% redemption rates.

Dormant client win-back: A patient who has not visited in 6+ months for a Botox practice (12 months for filler) is dormant. The win-back sequence — a personalized SMS from the injector, a time-limited offer, and a one-click rebooking link — typically reactivates 20-35% of dormant clients per cycle. Practices without a documented win-back workflow leak 30-50% of their lifetime client value to neglect.

The software requirement is a marketing engine that lives next to the patient record so segmentation can be precise — 'patients who bought filler in the last 12 months but have not been in for 6 months and have a birthday this month' is a real segment, not a hypothetical one. Disconnected marketing tools cannot build that segment without a data export, which means the segment usually does not get built.

A solo-injector med spa is a relatively simple operation. A med spa with two RN injectors, two aestheticians, a laser tech, and a medical director on file is six staff structures stacked on top of each other, each with different scopes of practice, different commission structures, and different supervision requirements.

Scope of practice: RN injectors administer neurotoxins and fillers under medical director protocols (state-specific). Aestheticians perform facials, peels, microneedling, and dermaplaning — but in most states cannot inject or operate Class IV lasers. Laser techs (where licensed) operate energy devices under supervision. The booking platform has to enforce the right service-to-staff mapping or patients end up scheduled for treatments their provider cannot legally perform.

Medical director oversight: State boards require varying levels of oversight — chart review percentages, on-site presence rules, standing protocols, and good-faith exam requirements. The chart system has to make MD review trackable; the schedule has to support whatever physical presence rules the state demands. California, Florida, Texas, New York, and Arizona have especially specific rules; cross-state operators face overlapping regimes.

Commission tracking: Injector compensation is usually a percentage of net treatment revenue (commonly 25-40% for RN injectors, 40-55% for MD/NP injectors), often with separate splits for product, service, and retail. Aesthetician compensation is usually flat hourly or a lower percentage on services. Tracking commission against the right revenue line, net of the right deductions (cost of goods on filler, for example), is where payroll either works or generates monthly arguments. The software requirement is per-treatment commission attribution at the chart level, rolling up to a payroll report by provider, by pay period, by line type.

Per-injector calendars and resource booking: Patients book a specific provider, but the room is a separate resource. The booking platform should manage both — provider availability and room availability — so a 90-minute laser appointment does not book the only laser room when another patient needs it for a peel.

A med spa is a medical practice. PHI lives in the chart, photos, consent forms, billing records, and the booking platform's patient profile. Compliance failures are not theoretical — state board complaints, HIPAA breach notifications, and malpractice exposure all flow from compliance gaps that are usually discovered after the fact.

HIPAA: Any platform handling PHI must offer a signed Business Associate Agreement, encryption at rest and in transit, audit logging of who accessed which record when, and role-based access controls. 'We use Google Drive for photos' is not HIPAA compliant; 'we email patients their before-and-afters' is not HIPAA compliant; 'we store consent forms in Dropbox' is not HIPAA compliant unless the BAA is in place and the workflow is configured correctly.

State medical-director rules: Most states require a medical director (MD or DO) of record for any practice administering injectables or operating Class IV lasers. The director's responsibilities, on-site presence requirements, chart review percentages, and protocol-signing duties vary by state. Some states (notably California with the Sherman Act, Florida with its specific delegation rules, Texas with its Medical Practice Act) have detailed delegation frameworks that govern what an RN or NP can do under a director's supervision. Multi-state operators have to track this per location; the platform should support state-specific protocol templates and director-of-record fields per location.

Photo consent specifics: Photo release is a separate document from treatment consent. Three levels of release are standard: (1) chart-only — clinical use, no marketing exposure; (2) marketing with face visible — website, social, in-clinic display; (3) cropped/treatment-area only — marketing exposure with no identifying features. The release should specify duration, revocation process, and any compensation. 'Implied consent' from the act of being photographed is not a defensible position if a patient later objects to seeing themselves on Instagram.

OSHA, sharps, biohazard: Standard medical-practice OSHA rules apply. Sharps containers, biohazard disposal, exposure control plans, annual bloodborne pathogen training, and SDS sheets for every product on the shelf. The training records belong in the HR side of the platform, not in a binder in the back room.

Five metrics tell you everything about a med spa's operational health. Most platforms can produce three of them; the better platforms produce all five.

Revenue per chair-hour: Total treatment revenue divided by occupied treatment-room hours. Strong practices run $300-$500/chair-hour for general aesthetics, $500-$900/chair-hour for injectables-heavy schedules. Trending this weekly catches a slowing schedule before it shows up in the monthly P&L.

Package conversion rate: Of patients who completed a single treatment, the percentage who bought a series or package within 30 days. Strong practices convert 30-50% of laser patients into series, 25-40% of aesthetic-treatment patients into packages. Low conversion almost always points to either the consult workflow (the recommendation is not being made) or the financing option (no payment plan offered).

Retail attach rate: Defined above. 35-55% strong, sub-15% weak.

Loyalty redemption rate: Of issued loyalty points or bank credits, the percentage actually redeemed. Sub-50% redemption is a sign that the program is not being communicated at checkout; 70%+ redemption is a sign that the staff is actively reminding patients.

Member churn / annual retention: Memberships should retain at 75-90% annually. Sub-65% retention is a sign that the membership value is being under-delivered (members feel they are not getting their money's worth) or the rebill process has too much friction (failed cards, no recovery flow).

These five, on a single dashboard, refreshed daily, will tell the operator more about the business than the P&L will.

There are five categories of software a med spa actually uses. The decision is whether they are five vendors with five integrations or one platform with five surfaces.

Practice management / charting: Patient records, charting, eConsent, photo management, treatment plans, package balances. This is the system of record for clinical work.

POS / retail / payments: Point-of-sale for treatments and retail, gift cards, packages, financing (CareCredit, Cherry, PatientFi), and Stripe-grade card processing. The POS has to be the same patient record as the chart, or retail attach disappears.

Marketing / CRM: Lead capture, segmentation, email/SMS, retargeting, review management, reactivation campaigns. The CRM has to know who the patient is, what they have purchased, when they were last in, and what their loyalty status is.

Photo management: Encrypted, HIPAA-compliant before-and-after capture, comparison views, with explicit photo release tracking. Modern platforms bundle this with charting.

Commission / payroll: Per-provider revenue attribution, commission calculation, payroll export. This can live in HR software but the source data is the chart and POS.

The five-vendor stack typical of older med spas — separate booking, charting, POS, marketing, photo — runs $700-$2,000/month all-in for a single-location practice with 4-6 staff and produces an integration burden that taxes the front desk every shift. A consolidated platform like Deelo (Practice + CRM + Invoicing + Marketing + ESign + Sheets, with the AI assistant tying them together) is $19-$69 per seat per month, which for a 6-seat practice runs $114-$414/month — a 70-85% reduction with less integration overhead. The trade-off is configuration work upfront (1-3 days to set up templates, consent forms, treatment plans, and the membership structure); for most practices, the savings and the workflow consolidation are worth it.

After years of watching med spas grow, fail, and grow again, the same five operational mistakes show up repeatedly.

Paper consents. Paper consents get lost, scanned poorly, and never make it into the chart. When the patient later disputes a treatment, the consent is either missing or unreadable. eConsent — treatment-specific, signed digitally, filed automatically against the chart — is non-negotiable in 2026.

Separate retail POS. A Square terminal next to the front desk for skincare sales, separate from the booking and charting platform. Retail attach rate plummets because the recommendation made in the room never reaches the front desk. Same patient record across treatment and retail is the fix, and it is worth thousands per month at any practice doing meaningful retail.

No loyalty program (or a loyalty program no one tracks). Allē and Aspire are table stakes; missing them costs new-patient acquisition. In-house memberships drive 2-3x revenue per member but require banked-credit tracking that most generic booking platforms do not handle. A spreadsheet membership program leaks 5-15% of revenue annually.

No photo standardization. Inconsistent angle, lighting, and framing across visits makes the comparison view useless and weakens any clinical defense. The standard fix is a camera setup with marked floor positions and a backdrop, plus a photo workflow that auto-tags by date, treatment, and area.

No documented reactivation workflow. Dormant clients (6 months for Botox, 12 months for filler) represent 30-50% of lifetime value if reactivated. Most practices have no documented win-back sequence and lose those clients permanently to a competitor's marketing.

Each of these mistakes is operational, fixable, and software-shaped. None of them require additional clinical investment. All of them compound over time in either direction.

Deelo's Practice app, paired with Marketing, Invoicing, ESign, and the AI assistant, runs the clinical, retail, and marketing trifecta on a single platform. Practice handles HIPAA-compliant charting, eConsent, and encrypted before-and-after photos with comparison views. Bookings and the appointment surface manage prep and recovery buffers, deposits, and per-injector calendars. Invoicing handles retail, packages, gift cards, banked-credit memberships with recurring billing, and the loyalty integrations that drive retention. Marketing covers lead capture from Instagram and Google, segmented post-visit campaigns, review requests, and dormant-client win-back sequences. The AI assistant drafts recall messages, summarizes treatment plans across visits, suggests follow-up cadences from the last filler date, writes consent for new services, and pulls package balances for the morning huddle without the front desk leaving the chart.

PHI and photos are stored through `EncryptedRepository` with audit logs, role-based access, and a signed BAA. Pricing runs $19-$69 per seat per month, which for a six-seat practice is materially below the all-in cost of a five-vendor stack and removes the integration tax paid every shift. Practices that value cost discipline, an integrated workflow, and an AI surface that actually understands the patient record evaluate Deelo against Boulevard, Aesthetic Record, Mangomint, and PatientNow as a peer — usually as the value play with broader scope and lower per-seat pricing.