Med Spa Online Booking Settings: What Patients Should Self-Book

Why Default Online Booking Settings Fail Med Spas

Default med spa online booking settings fail because most booking tools were built for salons, where any client can book any service at any open time. A med spa menu mixes services that anyone can book, services that need a medical exam first, and services only a provider should schedule. One global switch cannot handle all three.

The vendor guides ranking for this topic mostly cover speed and design. Zenoti's online booking guide is about fewer clicks, clear photos and simple service groups. PatientNow's booking article focuses on reminders and follow-up. Both are useful, and neither says which treatments belong online. That gap is where most of the cleanup work at the front desk comes from.

The setup mistakes that leak bookings, such as no deposit or a booking flow that breaks on mobile, are covered in our post on med spa booking setup errors. This post is about the rules layer underneath: once the flow works, what should it allow?

The Four Settings Every Bookable Service Needs

Every service on your menu needs four answers before it goes live online: whether patients see it, which patients can book it, how far ahead they must book, and what gets sent with the confirmation. If one of those is missing, the front desk ends up making the call by hand on every booking.

1. Visibility. Public, link-only (reachable from a direct link but not the main menu), or staff-only.
2. Eligibility. Everyone, returning patients only, or patients with a valid exam or active membership.
3. Notice and windows. Minimum notice before the start time, how far out the calendar opens, and the cutoff for online rescheduling.
4. Attachments. Card on file or deposit, intake forms, consents, and an exam request if the service needs one.

Owners who asked us about this usually had one of the four set and the other three left open. The usual gap is eligibility: a deposit is collected, but nothing stops a patient who has never had an exam from booking a treatment slot.

Which Med Spa Services to Put Online, Service by Service

Put services online when their length is predictable and nothing clinical has to happen before them. Keep the rest behind a consult or the front desk. The table below is our suggested starting point, built from the patterns clinics asked us about. Adjust it with your medical director, since the right answer depends on your state and your protocols.

Two rows cause most of the trouble. Filler for a first-time patient needs a plan, and a 30-minute slot rarely fits both the plan and the treatment. A provider-ordered assessment shown on the public menu invites patients to book something that only makes sense after a provider asks for it. One clinic that raised this simply wanted assessments to exist on the calendar without anyone outside the building seeing them.

New vs Returning Patients: Two Booking Paths

New and returning patients should take different paths through online booking, because a first visit carries an exam, intake and a treatment plan that a repeat visit does not. Showing both groups the same menu either makes returning patients jump through new-patient steps or lets new patients skip them.

Look at how clinics handle it on their own booking pages and you see the same three patterns: some require every new patient to book a consult no matter what they came for, some offer a separate "new patient neurotoxin" service with a longer slot, and some let returning patients book anything while new patients see a short list. Any of the three works. Mixing them on one undifferentiated menu does not.

The clinical reason is real. Neurotoxins and most injectables are prescription drugs, and states set rules on the exam that has to come first. California, for example, treats prescribing or furnishing a dangerous drug without "an appropriate prior examination and a medical indication" as unprofessional conduct under Business and Professions Code section 2242. Our guide to good faith exam requirements covers how often exams renew and who can perform them. For booking, the practical rule is simple: the exam request should go out with the confirmation, and the first slot should be long enough to complete it.

Minimum Notice, Booking Horizon and Reschedule Windows

Minimum notice is the shortest gap you allow between booking and the appointment, and for a med spa a sensible default is one day for new patients and a few hours for returning patients on short services. Requests we saw ranged from a full day for everything to 48-hour windows for online rescheduling.

The right number depends on what has to happen in between. If intake, consent and an exam all need to be completed and reviewed, a booking made 20 minutes before the slot leaves no time to do any of it. If the service is a returning patient's routine neurotoxin with everything current, same-day booking just fills an opening you would otherwise lose.

Booking software handles this in different ways, so check where yours puts the setting. Prospyr's help center, for instance, describes a practice-wide "booking buffer" for lead time set in minutes, hours or days, with cancellation and rescheduling windows that apply across the practice rather than per booking page. If your tool only offers one global number, set it for the strictest service and move the fast, low-risk services onto their own link.

Keep the online reschedule cutoff in line with the cancellation policy patients agreed to. If the policy charges a fee inside 48 hours but the booking page lets patients reschedule up to two hours before, staff will be refunding fees they were entitled to keep. Our guide to reducing med spa no-shows covers the policy side.

Private, Link-Only and Staff-Only Services

Hide a service from the public menu, rather than deleting it, whenever it should exist on the calendar but only some people should be able to book it. Most systems offer at least a staff-only setting, and many offer a link-only one too.

The cases clinics asked about fell into three groups:

• Provider-ordered visits. Assessments, lab draws and rechecks that a provider schedules after a visit. Patients booking these on their own end up in slots with no order behind them.
• No-charge touch-ups. A two-week neurotoxin touch-up that the clinic gives at no charge should stay off the public menu, or patients will book it whenever a result disappoints them.
• Member or invite-only services. Member pricing, VIP hours or a launch event belong on a link you send to that group, not on the main page.

Keeping a service staff-only also protects your data. Deleting it to hide it breaks the history on every past visit that used it, while a staff-only flag leaves reports intact. If you sell memberships, our guide to membership pricing and retention covers how members-only access fits into the offer.

Booking Links for Ads, QR Codes and Provider Pages

Send every paid ad, QR code and provider bio to a link that opens on one service, and when it makes sense, one provider. A patient who clicked an ad for lip filler should land on lip filler, not on a 40-item menu.

Several clinics asked us for exactly this: a link per service for ad campaigns, a link per provider for social profiles, and a QR code for front-desk cards and events. Separate links also answer the question marketing teams ask next, which is which campaign produced the booking. Give each campaign its own link and the booking record shows where it came from. Our post on tracking Google and Meta ad leads goes further into attribution.

One caution on tracking. Ad pixels on booking pages that collect health information can create HIPAA exposure. In June 2024, a federal court vacated part of HHS's guidance on online tracking technologies, the part covering unauthenticated pages, as Holland & Knight's summary of the ruling explains. The guidance for logged-in pages still stands, and state privacy laws can apply on their own. Ask counsel before you put an ad pixel inside a booking flow that asks about treatments or health history.

What to Attach at the Moment of Booking

Everything the visit needs should go out with the booking confirmation: intake forms, consents, the exam request when it is due, and the policy the patient accepted. Clinics that send paperwork later, a day before or on arrival, report the same thing: the morning is spent chasing forms instead of seeing patients.

• Card on file or a deposit for services where a no-show costs real money, such as filler and laser.
• Intake and consent matched to the service, so a facial patient is not asked to sign a filler consent.
• Exam request for prescription treatments when the patient's exam is missing or expired.
• Policy acknowledgment for cancellation and late arrival.

Appointment reminders that go out after booking are generally allowed under HIPAA without a separate patient authorization, as HHS explains in its appointment reminder FAQ. Text messages carry their own consent rules, covered in our guide to med spa text message consent. For forms, see our guide to med spa consent forms.

How to Audit Your Current Online Booking Setup

Audit your setup by booking every public service yourself, once as a new patient and once as a returning one, and writing down what you were allowed to do. It shows you exactly what your patients see.

1. Export the service list and mark each one public, link-only or staff-only.
2. Book a new-patient visit for each injectable and check whether a consult-length slot and an exam request appear.
3. Try to book 30 minutes from now and check the minimum notice for each service.
4. Reschedule inside your cancellation window and see whether the system lets you.
5. Open each ad and QR link and confirm it lands on the right service and provider.
6. Check that the confirmation email or text carries the forms the service needs.

Fix whatever surprised you, then repeat the audit whenever you add a service. New services are where the defaults creep back in. Buffers between visits deserve their own pass, covered in our guide to med spa appointment buffer time.

How Decoda Health Handles Online Booking Rules

Decoda Health's scheduling module gives new and returning patients separate self-booking paths, lets the patient choose location, service and time, and captures a card on file at booking rather than at the desk. Availability is checked against the provider, room and equipment together, so a slot only appears when all three are free. Services kept off self-scheduling stay bookable by the front desk, and each provider can have a dedicated booking link.

Booking also starts the paperwork. Decoda Health requests partner good faith exams (through Spakinect or Qualiphy) from the booking and sends the matching intake and consent forms with the confirmation. Patients who call instead of booking online can be scheduled by the AI front desk, which books into the same calendar.

Final Thoughts on Med Spa Online Booking Settings

Go through the menu one service at a time and answer the four questions: who sees it, who can book it, how much notice it needs, and what goes out with the confirmation. Route new injectable patients through a consult-length first visit, keep provider-ordered and no-charge services staff-only, and give every campaign its own link. Then book your own services once a quarter as a patient would. If you want to see these rules set up in one calendar, book a demo with Decoda Health.