Laws & regulations

The rules for med spas.

Med spas sit between medicine and retail, so they answer to state medical and nursing boards as well as federal privacy and advertising rules. These are the ones we build around.

5 specific rules · plus 12 for every clinic · Last reviewed 10 November 2026

How we build for med spas

01State lawState medical and nursing boards

State rules on who can inject and who supervises

Read the source

What it says

Neurotoxins and fillers are prescription treatments. Your state decides who can assess the patient, who can inject, what supervision is required, and whether a physician must be on site. The rules vary widely.

Your website: Injector profiles that show each provider's credentials accurately.
Your systems: Booking that only offers the providers your state and medical director allow for each treatment, with exams before treatment.
How we work: We encode the rules you and your medical director set; we do not decide them.

02State lawState law

Corporate practice of medicine

What it says

Many states restrict who can own or control a medical practice, which shapes how med spas are structured, often with a physician owned practice and a separate management company.

Your website: Business names and entity details shown correctly on the site.
Your systems: Records and permissions that respect the split between the medical practice and the management company.
How we work: No direct impact.

03LawFTC

Claims, photos, and product names

Read the source

What it says

You can generally name the FDA approved products you use, but claims must be truthful and backed by evidence, and before and after photos must reflect results patients can expect.

Your website: Real, unedited photos with measured wording, and product names used the way the manufacturer's trademark guidance asks.
Your systems: Marketing photo consent recorded separately from chart photo consent.
How we work: We do not retouch treatment photos, and we query results that look too good to evidence.

04RegulationHHS · OCR

Treatment photos and charts as protected health information

Read the source

What it says

Treatment photos and charts are protected health information, and using a patient's photo in marketing needs their written authorization.

Your website: Only photos with marketing authorization appear on the site.
Your systems: Photos stored in the chart, not on personal phones, with authorization easy to revoke.
How we work: No direct impact.

05State lawFTC · state attorneys general

Memberships and automatic renewal

Read the source

What it says

Med spa memberships billed automatically must show clear terms before payment and be easy to cancel under federal and state automatic renewal laws.

Your website: Membership terms shown clearly before sign up.
Your systems: Online cancellation and renewal reminders where your state requires them.
How we work: No direct impact.

Every clinic

Plus the rules everyone follows.

These apply to every US private clinic with a website. Each one is explained in full, with its impact, on the main page.

Guides for med spas.

Built in, not bolted on

A site that follows the rules.

We build every rule on this page into the websites and systems we make for med spas. This is a plain English summary, not legal advice, so check each source and check with your healthcare attorney, compliance lead, or state board.

Rules for other clinics