Choosing a med spa marketing agency: costs, contracts, red flags

What med spa marketing agencies typically sell

Most packages combine some of these:

• Paid ads on Meta and Google, often with landing pages or "funnels" built on the agency's own software.
• Website design and hosting.
• SEO and content.
• Organic social media posting and content shoots.
• Lead handling: text or email follow-up, a CRM, sometimes a call center.
• Reputation: review requests and responses.

Before comparing proposals, decide which of these you actually need. A spa with a strong front desk and an in-house content creator may need only ads and a better website; a new spa may need all of it. For the general market, see our guide to healthcare marketing agencies, and for how channels fit together, med spa marketing.

What good looks like

• A named strategist who has run aesthetics accounts and can explain the rules below without notes.
• Ads, website and listings in accounts you own.
• A written scope with prices, term and exit terms.
• Reporting on booked consults by treatment, from systems you can open yourself.
• A signed BAA before any client information changes hands, where HIPAA applies.

Compliance know-how to test for: neurotoxins, fillers, GLP-1s

Ask these in the first meeting. The expected answers below reflect the policies as checked on October 22, 2026; a good agency will know if they've changed since.

1. "Can we bid on 'botox near me' on Google?" Google's Restricted drug terms (opens in a new tab) policy, updated in October 2025 (opens in a new tab), lets US and Canadian advertisers use prescription drug terms in ads and landing pages without certification, but requires certification to keyword-target them. A good answer explains the difference and how they'd structure campaigns without certification.
2. "What do we need before running a Meta ad for semaglutide?" Meta's Drugs and Pharmaceuticals policy (opens in a new tab) requires active LegitScript certification, Meta's authorization, targeting of people 18+ in the US, Canada or New Zealand, and a disclaimer to consult a licensed professional.
3. "Can we show before-and-after photos of filler on Meta?" Meta's Health and Wellness policy (opens in a new tab) allows before-and-after transformations for cosmetic procedures in ads targeted 18+. A good agency adds that the photos need your clients' written consent and should show typical results.
4. "Rewrite this headline: 'Embarrassed by your double chin?'" Meta's personal attributes policy (opens in a new tab) bans copy that implies the viewer's condition, and Meta bans statements of inferiority about appearance. Look for a description of the service instead.
5. "Can our ad say our compounded semaglutide is the same as Ozempic?" No. The FDA says compounded GLP-1 drugs are not FDA approved (opens in a new tab) and has warned companies over claims that a compounded drug is the same as an approved one.
6. "Who can perform the treatments in our ads, in our state?" They should know that this varies by state and ask about your providers before naming anyone in an ad.

If an agency can't answer these without checking, that tells you how your ads will be handled.

Pricing models and contract terms

Agencies price in a few common ways. Our guide to agency pricing models covers each in depth.

That last row needs a lawyer before a signature. AmSpa describes fee-splitting (opens in a new tab) as paying a percentage of medical fees to a non-physician who brought in the patient, and says it is illegal in many states. Flat fees are the safer default.

Contract terms to check:

• Minimum term and notice period. How long until you can leave, and how much notice.
• Setup fees and what they buy.
• Ad spend billing. Paid directly by you to Google and Meta, or billed through the agency, and at what markup.
• Exit terms. What you keep: accounts, landing pages, creative, data.

This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.

Account ownership: ads, website, booking funnel, listings

Insist on owning everything in your business's name, with the agency added as a manager:

• Google Ads: your account, linked to the agency's manager account.
• Meta: your Business Manager, ad account, page and pixel; agency gets partner access.
• Website and domain: your registrar login and hosting account.
• Landing pages and funnels: if built on the agency's software, a written right to export pages and leads when you leave.
• Google Business Profile: your spa as primary owner. Google's Business Profile guidelines (opens in a new tab) also limit names to your real-world name, so decline "keyword-stuffed" listing names.
• Analytics and CRM: admin access and a tested export of contacts.
• Booking platform: keep your own login; give the agency the least access it needs.

Red flags

• The agency owns the ad account "for efficiency."
• No admin access to your own analytics.
• Lead forms that send health details into the agency's own systems without a BAA.
• Reports that only show impressions, clicks and "leads."
• Promises of a fixed number of bookings or a top ranking.
• A pitch built on another clinic's before-and-after photos.

HIPAA, client privacy and the BAA

Whether HIPAA applies starts with your status. CMS says providers that submit HIPAA transactions, like claims, electronically (opens in a new tab) are covered entities. If your med spa is one, an agency that creates, receives, maintains or transmits client health information on your behalf is a business associate, and HHS says you may share that information only after obtaining satisfactory assurances in a contract (opens in a new tab), the BAA. HHS's sample BAA provisions (opens in a new tab) show what it must cover: permitted uses, safeguards, breach reporting, subcontractors, and return or destruction of data at the end.

If HIPAA doesn't apply to you, client data still needs care. The FTC says disclosing health information for advertising without affirmative express consent (opens in a new tab) may be an unfair practice. Ask every agency:

• Will you sign our BAA, or offer yours?
• Where are consult forms stored, and who can see them?
• Are any pixels or tags on pages that collect health information?
• Do you upload client lists to Meta or Google?

This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.

Reporting: consults, bookings, rebooking and membership growth

Ask for a monthly report that tracks the whole path, by treatment and by source:

• consult requests (forms, calls, chats);
• consults booked, and consults attended;
• treatments and packages sold;
• memberships started and cancelled;
• rebooking within your normal treatment interval;
• cost per booked consult, by campaign;
• ad disapprovals, with the reason and fix.

Your booking platform or CRM holds the later steps, so the agency needs read access or a monthly export. Our aesthetic CRM guide covers how to tie leads to consults and rebookings. For which channels to fund first, see med spa ad channels.

The question checklist

• Who will run our account, and which aesthetics accounts have they run?
• How would you handle Botox, filler and GLP-1 ads on Google and Meta?
• Will we own the ad accounts, website, domain, funnels and listings?
• How are you paid, and is any part tied to treatment revenue?
• Is ad spend paid directly by us, and is it marked up?
• What is the minimum term, notice period and exit process?
• Will you sign a BAA, and where will client information be stored?
• Which pixels or tags will you install, and where?
• What will the monthly report show, and from which systems?
• What happens to our leads and pages if we leave?

Copy the questions into a spreadsheet with a column for each agency's answers. For a broader set, see our agency interview questions.

Agency vs platform: a factual comparison

When an agency is the better fit

Choose an agency if you want people to shoot content and post on Instagram, run review requests, send email or text campaigns, or answer calls. Medfy does none of those.

When a platform fits

Medfy suits spas that want their website, SEO, AI visibility tracking, analytics and ads run in accounts they own, at a fixed monthly price. The base plan covers the rebuilt website, weekly researched articles, weekly checks of ChatGPT, Gemini, Claude, Perplexity and Google AI Overviews, first-party analytics, Google reporting, the AI CMO dashboard and a patient CRM. See Medfy pricing, or get an independent audit of your current setup before you decide.

Frequently asked questions

How much does a med spa marketing agency cost?

It depends on the pricing model: a monthly retainer, a percentage of ad spend, a fee per lead, or a mix. We know of no reliable public benchmark, so compare written quotes on the same scope. Ask whether ad spend is billed through the agency or marked up, what setup fees apply, and how long the minimum term is. Avoid fees calculated as a share of treatment revenue.

What should a med spa marketing agency report?

Booked consults and treatments by source and by treatment, not just clicks, reach or leads. A useful monthly report shows consult requests, consults booked and attended, packages and memberships sold, rebooking, cost per booked consult, and any ad disapprovals with the fix. It should come from accounts you own, so you can check the numbers yourself.

Does a med spa marketing agency need a BAA?

If your med spa is a HIPAA covered entity and the agency will create, receive, maintain or transmit client health information for you, such as consult forms, chats or client lists, it is a business associate and needs a signed BAA first. Whether HIPAA applies depends on your covered-entity status. If the agency never touches client information, a BAA may not be needed.