Med Spa Reviews: How to Get More Without Risking Client Privacy

Nobody Books an Injector on Price Alone

Think about what a new client is actually deciding when they book their first appointment at a med spa. They are choosing who gets to put a needle or a laser near their face. The treatment is elective, the result is visible to everyone they know, and if it goes wrong they will be looking at it in the mirror for weeks.

That is why med spa reviews carry so much weight. A client cannot judge an injector's technique from a price list or a well-lit Instagram grid. What they can do is read what other clients said: did they feel listened to, did the result look natural, did anyone follow up when something felt off. Reviews are the closest thing a new client has to a referral from a friend.

According to BrightLocal's Local Consumer Review Survey, 41% of consumers "always" read reviews when browsing local businesses, and 31% will only use a business rated 4.5 stars or higher. For a purchase this personal, expect your prospective clients to read more carefully than that, not less.

This guide covers where aesthetics clients leave reviews, when to ask, how to reply without creating a privacy problem, and what changes when you run more than one location.

Where Med Spa Clients Leave Reviews

Google Business Profile

Google is where most new clients start. Searches like "Botox near me" or "laser hair removal" plus a city show the map pack first, with your star rating and review count visible before anyone clicks. Each of your locations has its own profile and its own reviews, so a strong rating at one clinic does nothing for the other.

If you only work on one platform, make it Google. Our guide to optimizing your Google Business Profile covers categories, services and photos for the profile itself.

RealSelf and Other Aesthetics Sites

RealSelf is a review and Q&A community focused on cosmetic treatments, and some clients research providers there before they book. It can matter for higher-ticket procedures, where clients spend longer researching. Whether it matters for your clinic depends on your market and your treatment mix; look at your own profile and how often clients mention finding you there.

If you decide to point clients at RealSelf, read its current rules for businesses first. StarFlywheel can send clients to any review link you choose, including RealSelf, but it does not monitor RealSelf reviews: only Google is monitored automatically, plus Yelp on the Growth and Pro plans.

Yelp and Facebook

Yelp has a following in some cities, and its rules forbid businesses from asking for reviews, so keep your page complete, answer what is posted, and send your requests elsewhere. Facebook recommendations travel through friends, which suits a business that grows by word of mouth. For how the big three compare, see our Google vs Yelp vs Facebook guide.

Why Aesthetics Clients Don't Leave Reviews

Most med spas have more happy clients than reviews. The gap usually comes from three things specific to this business.

The result is not visible yet when they leave. A client walking out after an injectable or a laser session may be red, swollen or simply unsure. Asking at checkout means asking before the thing they paid for has happened.

Many clients are private about treatment. Plenty of people are happy to tell a friend about their facialist and much less happy to post publicly that they get filler. A review request that ignores this gets ignored back.

Nobody owns the ask. The front desk is busy with checkout and rebooking, the provider has the next client in the room, and the follow-up text never gets sent. Without a process, the ask depends on someone remembering.

When to Ask: After the Result, Not After the Appointment

The single most useful rule for a med spa is to ask when the client can see what they paid for. That moment differs by treatment, and your providers already know it.

Injectables: at or after the follow-up

Many practices schedule a follow-up or touch-up check once results have settled. That visit is the natural moment: the client is looking in the mirror with the provider, the result is real, and any small adjustment has already been made. Ask at the end of that visit, or send the request the same day.

Laser and treatment series: after the series, not session one

For treatments sold as a series, the first session rarely shows much. Ask when the series is complete, or at a midpoint where clients typically notice change. A request after session one asks the client to review a promise rather than a result.

Facials and skin treatments: the same day works

Treatments where clients feel and see the difference straight away, such as many facials, are closer to a salon visit. A same-day text, a few hours after they leave, catches them while their skin still feels good. Our salon review strategy covers that rhythm in more detail.

Never ask for photos

Do not ask clients to include before-and-after photos, or any photos, in their review. It is a privacy risk for the client, it puts your practice in the position of having prompted the disclosure, and Google's contribution policy prohibits asking for specific content in a review. Before-and-after images you want to use in your own marketing are a separate topic, covered below.

How to Ask Without Breaking the Rules

Google tightened its review rules in 2026, and several of them land squarely on how med spas tend to ask.

Do not ask clients to name the injector

It is tempting to say "If you loved your lips, mention Jessica!" Do not. Google's contribution policy prohibits requesting "that specific content be included", and that explicitly covers content that identifies a staff member. The same goes for scripting treatment names, keywords or your city into the request.

Ask every client the same neutral question: "Would you share your experience with us on Google?" with one link. Clients who loved their injector will name her on their own, and those reviews read as real because they are. You can thank, quote and share them freely.

No review quotas for providers

Many med spas pay providers partly on commission, which makes review targets feel like a natural add-on. They are not allowed: Google's policy bars asking staff to "solicit a certain number of reviews". That rules out per-injector review counts, leaderboards, contests and bonuses tied to review numbers. Track the habit for the clinic as a whole (how many clients were asked, how many reviews arrived) and fix the process when asks drop.

No discounts, credits or points for reviews

"Leave us a review and get $25 off your next filler" is exactly the incentive Google prohibits: "payment, discounts, free goods and/or services" for a review. That includes loyalty points, a free add-on, or entry into a giveaway. The FTC's Consumer Review rule also targets incentives that are conditioned on a positive review. Keep your membership perks and your review requests completely separate.

Ask everyone, not just the happy ones

Sending requests only to clients who rated you highly in a survey is review gating, and Google forbids it. Send the same request to every client after the right moment for their treatment. If you text, get consent when you collect the number, include an opt-out, and keep the wording plain; our review request templates have SMS and email versions you can adapt.

Privacy: How to Reply Without Confirming Anyone Is a Client

This is where med spas get into real trouble, and where the stakes are higher than in most local businesses. A reply that feels like good customer service can disclose that someone was treated, and what for.

If your practice is a HIPAA covered entity

Some med spas are covered by HIPAA and some are not. Under HHS's covered entity rules, a health care provider is covered if it transmits health information electronically in connection with certain standard transactions, such as billing insurance. A clinic run under a medical director, or one that bills insurance for any service, may well qualify. Whether yours does is a question for your compliance advisor or lawyer, not a blog post.

If it does, the rule for reviews is strict: a reply must not confirm that the reviewer is a patient, and must not discuss their treatment, even if they described it themselves. HHS's Office for Civil Rights has acted against providers for exactly this. In 2022 it announced a $23,000 settlement with a California dental practice over patient information disclosed in responses to online reviews. In 2023 it announced a $30,000 settlement with a New Jersey psychiatric practice whose replies to negative reviews included a patient's diagnosis and treatment details.

If you are not covered, reply as if you were

Even outside HIPAA, state privacy laws and professional rules may apply, and the business case is the same. A future client reading your replies is asking one question: if I have a bad day here, will they talk about me in public? A clinic that never confirms who its clients are answers that question well.

What a safe reply looks like

• Do not confirm the relationship. Avoid "We're glad you loved your results" or "Thanks for coming in for your laser session".
• Do not repeat details. If the reviewer mentions a treatment, a product or a body area, do not echo it.
• Thank the words, not the visit. "Thank you for taking the time to write this. We will share it with our team" works for almost any positive review.
• Move problems offline. Give a phone number or email and a named manager, and stop there.

The same principles run through our guide to dental practice reviews, which faces the same constraint. If you use AI to draft replies, read every draft for these points before posting; our guide to AI review responses covers the workflow.

Before-and-after photos are a separate consent

Before-and-after images are among the most persuasive things a med spa can publish, and they are a different question from reviews. Using a client's photos in your marketing needs that client's written permission for that use, and if you are a covered entity, HIPAA has specific rules about authorizations for marketing. Keep that consent form separate from treatment consent and from any review request, and have your compliance advisor or lawyer review it.

Handling a Bad-Result Review

Negative reviews at a med spa tend to fall into a few groups: bruising or swelling that the client did not expect, a result they find too subtle or too much, a price that grew at checkout, or a front-desk experience that felt rushed.

The temptation is to explain, in public, that bruising is a normal side effect or that the client was told about it at consultation. Even if every word is true, that reply confirms they were treated and discusses their treatment. It also reads as defensive to every prospective client who sees it.

Reply short and general, then take it offline:

"Thank you for sharing this. We take every concern seriously and we would like to talk with you directly. Please call our clinic manager, [Name], at [phone] so we can help."

Then actually call. Many unhappy aesthetics clients want a provider to look at the result and tell them what happens next; a follow-up appointment often solves what a public argument never would. Our guide to responding to negative reviews has more templates. If a review is fake, from someone who was never a client, or an attempt to extort a refund, see our guide to removing fake Google reviews.

Running More Than One Location

Med spas often grow into small groups, and that changes the review problem in a few predictable ways.

Every location needs its own link and its own QR code

A client treated at your downtown clinic should land on the downtown clinic's Google profile, not the flagship's. Set up a separate review link and a separate QR code for each location, and make sure the follow-up text uses the link for the location where the client was treated.

Providers who float between clinics

If injectors work at several locations, the review should follow the visit, not the provider. Route requests by where the appointment happened. This also avoids any temptation to steer clients toward a particular provider's favorite location.

Same standards everywhere

One set of reply rules, one approved reply template for negative reviews, one person who checks new reviews each week. Group-wide reports make it easy to see which location has gone quiet. Our guide to multi-location review management covers the setup in detail.

A Simple System for a Busy Clinic

You do not need to do everything in this guide at once. Start with three things.

1. Pick the right moment for each treatment. Follow-up visit for injectables, end of series for lasers, same day for facials.
2. Use one neutral request for every client. No names, no photos, no discounts, one Google link.
3. Write your privacy-safe reply rules down. Put them where everyone who replies to reviews can see them.

StarFlywheel can handle the sending and the tracking. It sends email and SMS review requests on the timing you set, gives each location its own review link and QR code, monitors your Google reviews automatically on every plan, and drafts replies with AI on Standard and up for you to check and paste on Google. Plans run from $0 to $99/month; multi-location accounts start on Standard ($29/month, up to 3 locations), and Growth ($49/month) adds scheduled campaigns, segments, Yelp monitoring and up to 5 locations. See pricing for the full comparison.