How med spas get more Google reviews without a HIPAA problem
The checkout ask, the exact text to send, what you can and cannot say in a reply, and the review velocity that moves a clinic past the industry median.
Most med spas ask for reviews in the worst possible way: an automated email three days after the appointment, sent to a client who is still slightly swollen and not yet sure they love the result. The response rate is terrible, and the ones who do respond are the unhappy ones.
The timing problem in aesthetics is real and it is different from every other local service. A plumber gets relief at the door. You get relief at day fourteen, when the neurotoxin has settled or the filler has stopped bruising. Ask at the wrong point in that window and you are asking someone to review a face they are not happy with yet.
Across 53,312 med spa listings the median clinic has 50 reviews, 34.3% are under 25, and only 33.6% have passed 100. The clinics past 100 are not better injectors. They ask on a schedule and they ask twice.
The two-touch ask
Touch one happens at checkout, in person, and it is a setup rather than a request. The front desk says: "You are going to see the full result in about two weeks. I am going to send you a check-in text then, and if you love it, I would love a Google review." That sentence does two things. It sets the expectation that a text is coming, and it tells the client the review is expected of happy people only, which is the honest framing.
Touch two is the text, sent at day 14 for neurotoxin, day 21 for filler, and 48 hours for facials, peels and body treatments. Same day for a facial works because there is no downtime and the glow is the product.
The text:
"Hi [first name], this is [name] at [clinic]. You are right at the two-week mark, which is when results settle in. If you are happy with how everything looks, a quick Google review helps us more than anything else we do: [link]. If anything is not sitting right, reply to this text and I will get you in with [injector]."
That last line is not a courtesy. It is a valve. It routes the unhappy client to you instead of to a public review, and it does it without gating, because you are sending the review link to everyone regardless.
What Google actually prohibits
Google's review policy bans incentives of any kind for reviews, bans review gating (screening for happy clients before showing the link), and bans reviews from staff, family or anyone with a stake in the business. Offering a client 10 units off for a review can get reviews stripped and the profile suspended.
Sending the link to every client, at a chosen moment, with a path to complain privately, is fully within policy. So is one reminder. So is a QR code at the front desk. If you want to spiff your team, pay per ask logged in the system, not per review received.
The HIPAA line, and where clinics cross it
This is where aesthetic practices get into trouble that a restaurant never could. Under HIPAA, a patient can publicly say whatever they want about their own care. You cannot confirm any of it. The moment your reply says "thank you for trusting us with your lip filler," you have confirmed a treatment relationship and a service in writing on a public page.
Safe replies are short and generic:
- Positive: "Thank you for the kind words. We appreciate you taking the time."
- Negative: "We take this seriously and would like to talk with you directly. Please call the clinic and ask for our manager."
What you never do in a reply: name a treatment, name a provider in connection with the person, mention a visit date, dispute the person's account of what happened, or say "we have no record of you as a patient." That last one is the most common and the most costly, because denying someone is a patient still confirms you checked the chart.
Confirm your own policy with counsel and your medical director. This is a guide, not legal advice, and enforcement postures vary.
Velocity, and the number to run
Google weighs recency heavily. A clinic with 220 reviews and none in eight months looks like it is winding down. A clinic with 90 reviews and six from the last month looks busy.
A workable target is one review for every four completed treatments. A clinic doing 90 treatments a month lands around 20 reviews a month at that rate, which takes a median clinic at 50 reviews past the 75th percentile of 143 inside a year. Track it as a weekly number on the same board as revenue. If a week goes by with zero, someone stopped sending texts.
Ratings will not save you here. 45.1% of med spas already show a 5.0 and 89.4% are at 4.5 or better, so the star average is not a differentiator. The count and the dates are. The full picture is in the benchmark report.
Get reviews that mention the treatment and the town
Reviews that name a service and a city feed both Google's local ranking and the AI answer engines that now summarize businesses in a sentence or two. You cannot script a client's review, but you can prompt: "If you have a second, mentioning what you came in for and that you are local to [town] really helps other people find us."
Fifty reviews that say "Sarah did my Botox and I have never looked better, best med spa in Gilbert" do more for you than 200 that say "great experience." See the AI search guide for why the wording carries so far now.
A 90-day rollout
- Week 1: pull the short review link from your Google Business Profile, load it into a saved message on the front desk phone, and brief the team on the checkout sentence.
- Weeks 2 to 4: send the day-14 and day-21 texts manually from the front desk. Do not automate yet. You want to hear how clients reply.
- Month 2: add a single reminder at day 21 for anyone who did not respond. One reminder. Never two.
- Month 3: automate the send from your booking software, keep the manual reply handling, and start posting the weekly count next to your revenue number.
Frequently asked
Can I offer a raffle entry or account credit for reviews? No. Google's policy prohibits incentives and both practices routinely trigger review removal. Incentivize the ask, not the review.
A competitor is posting fake one-star reviews. What do I do? Report through the profile, reply once with the neutral negative template, and keep your velocity high. A run of fresh genuine reviews buries a fake one faster than any appeal will resolve it.
Should we ask on Yelp too? Yelp's guidelines discourage soliciting reviews and its filter is aggressive. Put the effort into Google, where the searches for injectables actually happen, and let Yelp accumulate on its own.
If you want the whole system built, texts, timing, tracking and HIPAA-safe reply handling, it is one of the services in the free 14-day trial. Text or call (385) 832-6175.