Home → Blog

Guide

Medical spa software in 2026: consents, before-and-after photos, packages and memberships

Per-treatment consents signed on the phone, before-and-after photos in the chart, packages, memberships, retail stock, deposits and device integrations.

October 28, 2026 · 12 min read

A medical spa is two businesses in one room. It is a medical practice, which means a legal chart, an informed consent per treatment and photographic evidence of the result. And it is a retail business that lives or dies on rebooking, prepaid packages, memberships and product on a shelf. Cloud based medical spa software has to be good at both, and most products are good at one.

The short version of what to demand: per-treatment consent templates signed remotely on the client's own phone, before-and-after photos attached to the visit date and comparable side by side, prepaid packages that count down, retail that deducts stock from the treatment invoice, a deposit taken at online booking, and automatic recall messaging timed per treatment. Device integrations, if you need them, run $30 a month each here. Everything in that list is a workflow rather than a feature, and you can test every one of them in an afternoon on any vendor's account, including ours for medical spas.

Consents: the thing that decides a lawsuit

Every injectable, laser, radiofrequency and chemical treatment needs a signed informed consent covering that specific treatment. Not a general clinic consent signed once in 2024. A toxin consent names toxin risks: ptosis, asymmetry, bruising, headache, the possibility of no result. A laser consent names burns, pigment change and the photo protection rules. A filler consent names vascular occlusion. Your malpractice carrier will ask which version the client signed and when.

Two things make this work operationally rather than aspirationally.

A consent template per treatment, held in the software. Not a PDF in a shared drive that someone prints. When the treatment is booked, the right consent is the one that goes out.

Remote signature on the client's own phone, before they arrive. A link, a signature, a PDF filed into the chart with a record of who signed what and when. This is included on every plan in our remote e-signature, and the reason it matters is not convenience. It is that a client who signs at the desk thirty seconds before the needle has not meaningfully consented, and a client who signs at home the night before has read it.

One thing we do not offer in the United States: tablet signature pads. Signature is by link on the client's own device. If your workflow depends on a hardware pad at the counter, that is a real gap and you should know it before you buy.

While we are on documents: a med spa is a self-pay business, which means every client is owed a Good Faith Estimate under the No Surprises Act. CMS's model estimate shows what it contains and spells out the consequence: a client whose bill is "$400 or more for any provider or facility" above the estimate may dispute it, must start "within 120 calendar days (about 4 months) of the date on the original bill," and pays a $25 fee to do so (cms.gov). Almost no med spa issues these. The data is the same data as your treatment quote, so build it as a template once.

Before-and-after photos are clinical records, not marketing assets

They are both, which is the confusion. The clinical function comes first: photos attached to the treatment date, in the chart, comparable side by side, are your evidence of what the skin looked like before you touched it. The marketing function is real but secondary, and it needs a separate written consent for use of images, which is not the same document as the treatment consent.

Three rules that keep this out of trouble:

1. Photos live in the chart, not on a phone. A staff member's camera roll holding client faces is a HIPAA problem with legs. Attach to the visit, inside the system, under per-user permissions.
2. Same lighting, same angles, same distance, every time. Otherwise the comparison proves nothing, including to the client deciding whether to buy another round.
3. Image-use consent is separate and revocable. Treatment consent does not authorize Instagram.

What our software does not do: there is no AI image analysis, no automated skin scoring, no simulation of outcomes. That is in development and we are not going to promise it. If vendor-specific skin imaging is central to your consultation, keep your imaging device and its software, and store the exported images in the chart.

[CAPTURA: dos fotos de antes y después de la misma paciente abiertas en paralelo desde la visita]

Packages and memberships: where the revenue actually comes from

A single toxin appointment is a transaction. A package or a membership is a business. The arithmetic is worth seeing, with my assumptions stated: a $600 average treatment ticket, a client who comes three times a year on her own, against a six-session package and a $149 monthly membership.

Model	Price	Annual revenue per client	Cash in month 1	Retention effect
Pay per visit	$600	$1,800 (3 visits)	$600	None
6-session package	$3,060 ($510 each)	$3,060	$3,060	Prepaid, so she returns
$149 monthly membership	$1,788 a year	$149	$1,788	Charged whether she comes or not
Membership plus two treatments	$1,788 + $1,020	$2,808	$659	Highest of the three

Those are illustrative numbers, not survey data. Run them on your own ticket and your own visit frequency. The pattern holds anyway: Bain's research on retention is commonly cited as a 5% increase in retention raising profit between 25% and 95%, and in aesthetics the mechanism is simply that a prepaid client comes back.

Now the honest part about what we do. Prepaid packages and installment schedules are built in and count down per session. Automatic recurring monthly card charges are a setup question to raise before you buy, not something to assume works out of the box. If a membership program with auto-renewing monthly billing is the center of your business model, test that specific flow with your own card before committing, or buy a product built around subscription billing. We would rather lose the sale than have you discover it in month two. The wider case for packages and memberships, including the cash-flow trap, is in our write-up on memberships, packages and recurring revenue.

A compliance point on memberships that catches practices every year. The FTC's enforcement policy statement on negative option marketing says marketers "must clearly and conspicuously disclose the material terms of a negative option offer," "must obtain consumers' express informed consent to such offers," and "must not erect unreasonable barriers to cancellation," and lists the same three obligations under ROSCA for internet sign-ups (ftc.gov). Disclose the terms in writing, capture express consent at signup, and let people cancel without a phone call. Several states add their own auto-renewal statutes on top, so ask your attorney about yours.

Retail that counts itself

Product is the highest-margin line in a med spa and the easiest to lose track of. Two failure modes: you run out of the serum you recommend in every consultation, or you carry $4,000 of inventory that expires.

The mechanism that fixes it is stock that falls when you invoice the sale on the treatment ticket, so the count is a byproduct of getting paid rather than a Sunday chore. Product invoices should run on their own numbered series, because the retail side has a different sales-tax and bookkeeping story from the service side. You also want expiry warnings, because aesthetics inventory has dates on it.

Line	Cost	Retail	Units per month	Monthly margin
Medical-grade serum	$42	$110	22	$1,496
Sunscreen	$14	$42	35	$980
Retinoid	$26	$78	15	$780
Post-treatment kit	$18	$55	20	$740

Illustrative numbers again, but a retail program producing around $4,000 a month in margin is a second staff member's salary, and it disappears quietly when the shelf is empty.

Deposits, and the empty chair

An aesthetics no-show is expensive in a way a primary care no-show is not, because the slot is 60 to 90 minutes and the ticket is in the hundreds. Studies put the average no-show rate around 5% to 7% when reminders go out and 15% to 20% without them, and the generic cost of a lost slot at $150 to $250. In a med spa with a $600 average ticket the real number is far worse.

The fix is a card at the moment of booking. Not a promise, a card. Our online booking widget takes a deposit or the full price when the client books, with availability per provider and per treatment, and it embeds on your own site or links straight from an Instagram bio. Set the cancellation window once and let the software enforce it.

Do the math on a single provider: 6 appointments a day, 20 days a month, $600 average ticket is $72,000 of booked capacity. Cutting no-shows from 15% to 6% returns about $6,480 a month. A deposit policy and automatic reminders cost nothing beyond the SMS pack, which is $36 for 300 messages here.

The policy has to be written, signed at intake and applied the same way to everyone. And keep TCPA consent for text messages in the intake form; penalties are commonly cited in the $500 to $1,500 per message range, which makes a checkbox the cheapest insurance in the building.

Recall marketing, set once

Aesthetics lives on rebooking, and rebooking is a timing problem. The client who had a toxin treatment in March needs to hear from you at the interval you use clinically, not when someone remembers.

The mechanism is a rule: if treatment X happened, send message Y after Z days. Set it per treatment, once, and it runs on its own. Add the automatic post-treatment aftercare email, the satisfaction survey after each visit, the birthday message, and the referral source recorded on every new client so you learn whether Instagram or the dermatologist down the street actually fills your book. That bundle is what our client CRM and recall campaigns do, and it is included from the Clinic plan at $119 a month or as a $10 add-on on Essential at $49.

One more piece of the same machine, the one most clinics skip: the follow-up scheduled from inside the chart while the client is still in the room. One click, "time for your next session" in 90 days. Done later, it is never done. If you want the channel-by-channel version of this, read the cash-pay clinic marketing guide.

Devices, and what integration actually means

Clinics ask whether the software talks to their equipment. Sometimes. Device and analyzer integrations are available at $30 a month each, and API access is $300 to set up plus $80 a month if you want to build something yourself. There is no hourly development service.

What to do before you count on it: name your exact device, model and software version, and ask whether that one is supported. A generic yes about "device integrations" means nothing. Most aesthetics devices have no outbound data interface at all, in which case the honest answer is that you export from the device and attach the file to the visit, which is what most clinics do anyway. Our integrations and API page lists what connects, and Stripe, Google Calendar and WhatsApp are the ones most med spas actually use.

What we do not do

Four disqualifiers, stated plainly so you can stop reading if one applies:

• No insurance claims. Aesthetics is self-pay, so this is rarely a problem, but if your practice has a reconstructive or medical dermatology side that bills payers, that side needs different software.
• No e-prescribing. Prescriptions print or go out as PDF. States with electronic prescribing mandates, including California, Florida, New York, Michigan, Minnesota and Delaware, require a separate e-Rx platform, and if you prescribe lidocaine, antivirals or hyaluronidase you will need one.
• No AI image analysis or outcome simulation. In development, not available, not promised.
• No free trial and no guided sales demo. Signup is paid, online, about three minutes, and the smallest commitment is one month.

And the case for buying something else: if your med spa is primarily a spa, with classes, memberships at scale, retail as the main revenue line and no real clinical charting, the booking-and-point-of-sale products built for salons will serve you better and cost less. If you run a laser-heavy practice tied to one manufacturer's imaging platform, that manufacturer's software may be the hub and ours is the wrong center of gravity. Where we fit is the clinic that is genuinely medical, with charts, consents and photos it is legally obliged to keep, and that also needs to sell packages and rebook. That is what the medical spa setup is built around.

Frequently asked questions

What should cloud based medspa software cost per month?

Our plans are $49 a month billed annually for one injector, $107 for one user with the client portal and unlimited video included, $119 for one to three injectors, and $287 for four to thirty across locations, with month to month at $59, $128, $143 and $344. The AI client chatbot is $20 a month per practice and device integrations are $30 a month each. Comparable list prices read on other vendors' pricing pages on October 28, 2026 ran from $33 to $155 for the base plan, plus card processing everywhere.

Does medical spa software need to be HIPAA compliant?

Yes. Medical aesthetics is healthcare, the chart and the photos are protected health information, and you need a signed Business Associate Agreement from your software vendor. Ours is included on every plan at no extra cost, with encryption in transit and at rest, per-user permissions and continuous backup. A booking app with no BAA is not a lawful place to store client faces.

How do clients sign treatment consents?

By link, on their own phone, before the appointment. You hold a consent template per treatment, the right one goes out when the treatment is booked, and the signed PDF files itself into the chart with a record of who signed what and when. Remote signature is included on every plan. We do not offer tablet signature pads in the United States.

Can the software handle monthly memberships?

Prepaid packages and installment plans are built in and count down per session, which covers most package selling. Automatic recurring monthly card charges are a setup question to raise with us before you buy rather than something to assume. If auto-renewing memberships are the core of your revenue, test that exact flow first, and remember the FTC requires clear disclosure, express consent and simple cancellation.

Can I store before-and-after photos and compare them?

Yes. Photos attach to each treatment date inside the chart, any two can be opened side by side, and they can be shared securely through the client portal. There is no AI analysis, no skin scoring and no outcome simulation. Keep a separate written consent for using any image in marketing, because the treatment consent does not cover that.

Will it connect to my laser or body analyzer?

Possibly, at $30 a month per integration, and API access is $300 to set up plus $80 a month. Give us the exact device, model and software version and ask about that one specifically, because many aesthetics devices have no outbound data interface at all. When they do not, you export from the device and attach the file to the visit.

DrinCloud is practice management software for clinics the client pays directly, with consents, before-and-after photos, packages and recall marketing from $49 a month. No claims engine, no e-prescribing. See the medical spa setup.

← All articles