Salon vs med spa reputation management: same reviews, different rules

Two businesses on the same strip mall get the same review on the same Saturday. “Obsessed with my results. Booked for a friend already, you will not regret it.” One of them should screenshot it, reply warmly by name, and pin it to the top of their profile. The other one should reply in three careful sentences that confirm nothing, and think hard before amplifying it anywhere.

The first is a hair and nail salon. The second is a med spa two doors down. They both sell “beauty,” they both live and die by their star rating, and their owners probably use the same booking software. But only one of them is running a medical practice, and that changes what a review is. For the salon a five-star rave is marketing. For the med spa the exact same words can be a testimonial it now has to stand behind, in front of the FTC and a state medical board.

That is the whole argument of this post: “beauty” is two different regulatory animals wearing one word, and the review-response playbook that grows a salon can quietly build a liability file for a med spa. If you own or market both, or a hybrid that does highlights in one room and Botox in the next, you need two playbooks, not one.

Why the salon side is the easy side

Start with the salon, because it is the part everyone already gets right by instinct. A hair colorist, a nail tech, a lash artist, a barber: these are personal-care service businesses. Nobody is prescribing anything. There is no “good faith exam,” no licensed medical director, no protected diagnosis sitting behind the haircut. When a client writes “Best balayage in Tucson, Mia is a genius,” the salon can reply “Mia will be thrilled, thank you for the love, see you in eight weeks,” and the biggest risk in the whole exchange is a typo.

Salons should be aggressive here. Name the stylist. Confirm the service. Invite them back. Reshare the rave on Instagram. The ordinary review math applies cleanly, and it is brutal for anyone who ignores it: BrightLocal’s 2026 Local Consumer Review Survey found 97% of consumers read reviews for local businesses, 68% will only use a business rated four stars or higher, and 74% specifically want reviews written in the last three months. For a salon, recency and volume are the entire game. Ask every happy client. Respond to everything. Keep the flywheel spinning. There is no compliance brake.

One salon-specific wrinkle that a generic “reputation management” post will miss: for salons and spas, a big chunk of your reviews do not live on Google at all. They live inside the booking tool. Vagaro and Boulevard both collect post-appointment reviews and feed a marketplace where new clients discover you. Vagaro’s own marketplace pushes organic booking traffic to listed businesses, which means a review left inside Vagaro is doing double duty as a ranking signal on a platform your Google-only competitor never thinks about. Salons should treat those in-app reviews as a first-class surface, not an afterthought, and respond to them with the same energy they give Google.

Where the med spa quietly stops being a salon

Now the two doors down. A med spa that does injectables, laser resurfacing, or body contouring is not a fancier salon. In most states it is the practice of medicine, full stop. Botox is a prescription drug. A laser is a prescriptive device. In California, for example, the Medical Board of California treats these as medical procedures that require a supervising physician and an appropriate prior exam that establishes a real doctor-patient relationship, an exam that cannot be delegated to a registered nurse. The person doing your filler is operating under a physician’s delegation order, not a cosmetology license.

Follow that thread to its end. If the treatment is medical, then a review describing the treatment is describing a medical outcome. And a public response confirming that outcome is the practice of medicine talking about a specific patient’s results in an advertising channel. That is a different room than “Mia is a genius,” even when the words on screen look identical.

Here is the sentence to tape to the monitor of whoever answers your reviews: a med spa review that names a procedure, a provider, and a result is a testimonial, and under FTC rules a testimonial you adopt is treated as a claim you made yourself.

The counterintuitive part: the glowing review is the dangerous one

Everyone braces for the one-star. In a med spa, the review that should make you slow down is the five-star.

“My Botox looks amazing, Dr. Lee is a miracle worker, took ten years off my face, worth every penny.” A salon owner reads that and reaches for the pin button. A med spa owner should read it and see three separate exposures stacked in one happy paragraph.

The FTC’s Endorsement Guides, updated in July 2023, are explicit that an endorsement can’t convey anything that would be deceptive if the business said it directly. So the moment you reply “So glad your Botox took ten years off, Dr. Lee does incredible work,” you have adopted the “ten years off” claim as your own advertising. Now you own the substantiation problem. Is a ten-year visual reduction the typical result of your Botox, or a best case? The FTC’s health-products guidance is blunt on this: a testimonial about a health outcome is never a substitute for actual evidence, and “results not typical” style disclaimers do not cure a misleading impression. You either can substantiate that a typical patient gets that result or you cannot repeat it.

Then there is the provider. “Dr. Lee is a miracle worker” reads lovely and lands on a named licensee’s permanent professional record. When the practice publicly affirms it, the practice is making a comparative competence claim about a specific doctor, the kind a medical board can treat as advertising subject to substantiation. A glowing named-provider review is not a trophy to boost. It is a claim to handle.

This is the inversion nobody warns med spas about. The negative review follows a knowable script. The rave is where you volunteer to co-sign someone else’s medical claim in writing, in public, forever. Handle it with more care than the complaint, not less.

The med spa response rules, concretely

None of this means a med spa goes silent or sounds like a legal disclaimer. It means the reply is built to be warm without confirming or claiming. Four working rules.

Don’t confirm the specific procedure or result. You can thank someone for kind words without ratifying that they got Botox, or that it took ten years off. Thank the sentiment, not the clinical fact. “We’re so glad you had a great experience with us” does the emotional work. “So glad your Botox turned out perfect” adopts a medical claim.

Don’t publicly confirm the provider treated them. Praise the team, not the named injector on a named patient. “Our clinical team loves hearing this” keeps a licensee’s individual record out of a public advertising claim. Naming Dr. Lee back ties one doctor’s license to one patient’s stated outcome.

Keep substantiation in mind on every affirmation. Before you echo any specific result a reviewer mentions, ask whether that result is typical and whether you could prove it. If the answer is no, do not repeat it, even to be nice. Generic warmth is always substantiable. Specific outcomes rarely are.

Keep patient discretion even if HIPAA technically doesn’t bind you. This is the nuance that trips up med spa owners who have read a little. A cash-pay med spa that never submits an electronic insurance claim may not be a HIPAA “covered entity” at all, so people assume the privacy rules just don’t apply. Two problems. First, plenty of med spas do run a covered electronic transaction somewhere and are covered without realizing it. Second, and more important, the FTC and your state medical board reach you regardless of HIPAA status. Confirming a stranger’s medical treatment in public is a bad look and a board-complaint risk whether or not a federal privacy statute technically attaches. Treat every reviewer as a patient whose care you will not discuss publicly. The dental version of this exact problem, where HIPAA very much does apply, is worth reading for the parallel: our guide to dental review responses walks the covered-entity side in detail.

A worked example

Lumen Aesthetics, a med spa in Scottsdale, gets this five-star review on a Tuesday:

“Came in for my first tox and lip filler and I am OBSESSED. Nurse Bri completely fixed my smoker’s lines and my lips look natural, not overdone. She said most people need way more product than I did. Genuinely looks like I got a facelift. Cannot recommend Lumen enough!!”

The trophy-instinct response, the one a salon would fire back in thirty seconds:

“Bri is going to scream, thank you!! So happy your tox and filler healed perfectly and gave you that facelift result with less product. You’re going to love how it settles. See you at your two-week touch-up!”

Count the problems in one friendly reply. It confirms the specific procedures on a named patient. It adopts “facelift result” as Lumen’s own claim, a surgical comparison for a non-surgical injectable that Lumen now has to substantiate as typical. It ratifies “less product than most people,” an efficacy claim. And it pins a named nurse’s license to all of it. That is not a celebration. It is an advertising-substantiation file with a smiley face on it.

The compliant response, still warm, still human:

“This absolutely made our week, thank you for the kind words. Our whole clinical team cares a lot about natural-looking, individually tailored treatment plans, and hearing that your experience felt that way means everything to us. We can’t wait to see you again.”

It confirms no procedure, adopts no result claim, names no provider on a patient, and still reads like a real person who is genuinely happy. Nobody scrolling past thinks Lumen is cold. They think Lumen is gracious. Lumen ran this reply style across every review for a quarter and their profile did exactly what a warm, active profile does: response rate on new reviews went to 100%, and their consult booking rate from the Google profile rose 23% over the prior quarter. The careful version did not cost them a single booking. Discretion read as confidence.

(The invented numbers are illustrative, but the mechanism is real: the constraint that stops you from over-claiming also stops you from sounding desperate, and composed beats gushing on a profile strangers are judging.)

The incentivized-review trap both sides share, and the med spa makes worse

Salons and med spas both love a “review for a discount” promo. The FTC’s rules ban undisclosed incentivized reviews outright, so any “$10 off your next visit for a review” has to be disclosed as an incentive by the reviewer, and you cannot condition the reward on the review being positive. That is true for the salon too.

The med spa version is nastier. If you give a patient free or discounted treatment in exchange for a before-and-after photo or a testimonial, that is a material connection the FTC says must be disclosed, and the testimonial still has to reflect typical results. So the med spa’s incentivized before-and-after is carrying two obligations at once: disclose the freebie, and don’t imply an atypical outcome is normal. A best-case result photo with no disclosure is the single most common way aesthetics practices step on this rule. If any part of your review pipeline touches money or free product, get the disclosure mechanics right before you scale it.

When the med spa review is actually negative

A negative med spa review adds a layer the salon complaint never has: the reviewer may be describing an adverse medical event. “My eyes drooped for a month after my Botox” or “I had a burn from the laser” is not a service complaint you argue about in public. It is a clinical matter, and a defensive public reply that discusses the treatment can both create a substantiation problem and hand a board investigator a tidy written record.

The move is the generic-warmth-plus-private-channel structure. Thank the person, state that your clinical team takes any concern about a treatment seriously, and route them to a named contact offline. Do not diagnose, do not defend the technique, do not explain what “must have happened.” If the review alleges an actual adverse event, that goes to your medical director and, in most cases, your carrier the same day, entirely separate from whatever you post publicly. The legal reasoning for keeping response text clean under regulatory pressure is the same reasoning we lay out in the legal line on review responses, and it applies with extra force when the “service” is a scheduled drug or a class-of-device laser.

If you want a starting structure for the difficult ones, there is a set of templates organized by the tone of the review that gives you a compliant skeleton to adapt, which beats writing an emotional reply from scratch at 9pm when a bad one lands. For a med spa, treat any template as the floor and tighten from there against your state’s specific advertising rules.

If you run a hybrid, split the queue

The messiest case is the business that does both under one roof and one Google profile: blowouts and facials on one side, tox and laser on the other. All the reviews land in the same inbox, and the front-desk person answering them cannot use one voice for all of it.

Split the queue by what the review is actually about, not by which business you think you are. A review about the haircut gets the full salon treatment: name the stylist, confirm the service, amplify away. A review that so much as mentions injectables, a laser, “results,” or a named clinical provider gets routed to the med spa rules and, ideally, a second set of eyes. Write it down as a one-line triage rule and train whoever holds the login. The failure mode is not malice, it is a friendly receptionist treating a Botox rave like a balayage rave because both made a customer happy.

The through line

Reputation management for “beauty” is not one discipline. It is a marketing job and a compliance job that happen to share a waiting room. The salon owner’s instincts, ask for reviews, answer fast, name names, celebrate loud, are correct for the salon and slightly dangerous for the med spa. For the broader system that ties both of these into one profile strategy, the small business reputation management guide covers the shared plumbing. The split above is the part specific to the two businesses hiding under one pretty word.

The tell that you have internalized it is simple. The next time a med spa client writes that your work took ten years off their face and your provider is a miracle worker, your first feeling is not pride. It is care.