AI Chatbot for Med Spas: What It Should Answer, Where It Must Stop, and HIPAA (2026)

Sean Scalabrini
Sean Scalabrini
November 12, 2026
9 min read
What an AI chatbot on a med spa website should answer, where it must hand over to your clinical team, and when HIPAA calls for a BAA. CallPad offers a BAA in every plan.

Quick answer: An AI chatbot for a med spa sits on your website and answers patients' questions at any hour: which treatments you offer, how consultations work, your hours, location, deposit and cancellation policies, and how to book. It should never diagnose, recommend a dose or say whether a treatment is safe for someone; those questions go to your clinical team. If the chatbot handles patient health information for a HIPAA covered entity, the vendor is usually a business associate and you need a BAA. CallPad gives med spas a website AI chatbot alongside its 24/7 AI receptionist and AI texting, and offers a BAA in every plan.

By Sean Scalabrini, CTO and co-founder of CallPad. Updated 12 November 2026. HHS guidance below was checked 12 Nov 2026. This is general information, not legal advice. CallPad makes these tools, so we have a stake in this topic.

Table of Contents
‍

What does an AI chatbot do for a med spa?

Most med spa questions arrive outside clinic hours, when someone has just seen a before-and-after photo or a friend's result and is reading your treatment pages at night. A website AI chatbot answers them there and then, in plain words, from the information you give it. Instead of a contact form that waits until morning, the patient gets an answer and a clear next step: book a consultation, ask for a callback or call the clinic, where an AI receptionist can pick up 24/7.

For the bigger picture of AI at a med spa, from the receptionist to reports, see AI for med spas.

What should a med spa chatbot answer?

Keep it to the practical, non-clinical questions your front desk hears every day:

  • which treatments you offer, such as injectables, fillers, laser hair removal, chemical peels, facials and body treatments
  • how consultations work, how long they take and whether there is a consultation fee
  • your deposit, cancellation and late-arrival policies
  • opening hours, location, parking and which providers work on which days
  • packages, memberships and gift cards, if you sell them
  • what to expect on the day and how to prepare, using your own approved wording
  • how to book, reschedule or ask for a callback

If your consultations need a deposit, see how clinics handle consultation fees and deposits by phone.

Where must a med spa chatbot stop?

A med spa is a medical business, so the chatbot needs a firm line. It should not:

  • diagnose a skin, weight or hair concern
  • recommend a treatment, product, dose or number of units
  • say whether a treatment is safe with a medication, pregnancy or a health condition
  • give aftercare advice beyond the written instructions your providers approved
  • handle complications or urgent symptoms, which should go straight to your clinical team or emergency services

The right answer to these is a polite handover: a provider will answer that, here is how to book a consultation or get a call back. Read more in how a med spa AI receptionist handles medical-advice questions.

Does a med spa chatbot need a BAA under HIPAA?

Often, yes. HIPAA applies to covered entities, which include health care providers that transmit health information electronically in connection with certain transactions, such as insurance billing. Many US med spas with a medical director fall into that group; some cash-only spas may not, so check with your compliance adviser. According to the HHS business associates guidance (checked 12 Nov 2026), a vendor that creates, receives, maintains or transmits patients' protected health information on behalf of a covered entity is generally a business associate, and the covered entity needs a business associate agreement (BAA) with it. HHS even lists a third-party chatbot on a provider's patient portal that handles patients' health information, for example for appointment scheduling, as an example.

In practice, a chatbot on a med spa website will hear names, phone numbers and treatment interests, and patients sometimes type health details unprompted. So ask any chatbot vendor for a BAA before you switch it on. CallPad offers a BAA in every plan. More in HIPAA and AI receptionists for med spas. In the UK, Australia and Canada, the rules are different (UK GDPR, the Australian Privacy Act and Canada's privacy laws), so ask your adviser what applies.

Is a chatbot enough, or does a med spa also need an AI receptionist?

A chatbot only helps people who are already on your website. Many med spa patients still pick up the phone before they book a consultation, especially for injectables and laser treatments, and some prefer to text. That is why the chatbot works best as one part of the front desk, next to an AI receptionist that answers every call 24/7 and books into your system, and AI texting that answers messages and texts back callers who hang up. See AI receptionist for med spas and best AI receptionist for med spas.

How do you choose an AI chatbot for a med spa?

Ask every vendor the same questions:

  • Will you sign a BAA, and does it cover the chatbot as well as calls and texts?
  • Can I control exactly what it says about treatments, and stop it answering clinical questions?
  • What happens when a patient asks something it shouldn't answer: does it hand over to my team?
  • Does the same system answer my phone and texts, so patients get the same answers everywhere?
  • Does it work with my booking software?
  • Is the price flat, or charged per minute or per conversation?

Your booking software may have its own tools too. If you run Zenoti, see AI receptionist for Zenoti med spas. Spa owners can compare with AI chatbot for spas, and hair salons with AI chatbot for hair salons.

Running several med spas?

Groups need the same answers at every location, with each clinic's own hours, providers and prices. CallPad works across locations with one number or a line per location, gives head office control over shared policies and scripts, and reports per location and group-wide. See multi-location med spa phone calls and CallPad for salon, spa and clinic groups.

How CallPad helps med spas

  • a website AI chatbot that answers patients' questions at any hour
  • an AI receptionist that answers every call 24/7 and books consultations and appointments in real time
  • clinical questions passed to your team instead of answered by the AI
  • AI messaging and texting: texts, WhatsApp and email are live (Instagram, Messenger and TikTok coming soon)
  • text-back for callers who hang up before anyone answers
  • deposits taken on calls by payment link, gift card sales, and texts to waitlist patients when a slot opens
  • help filling empty slots, business analysis reports and predictive analysis
  • SEO and AEO help so patients find you on Google and in AI answers
  • a BAA in every plan
  • several languages; ask our team
  • setup in about 10 minutes

Which med spa booking software does CallPad work with?

CallPad books in real time into Zenoti, Vagaro, Meevo, Boulevard, Cliniko, Mindbody, Booker, Square, GlossGenius, Setmore, Zoho Bookings, SalonIQ, Salon Manager, Shortcuts, Simple Salon, Book4Time and Google Calendar. Phorest works when the business gets its own API key from Phorest, and basically any other system works where the business can provide its own open API key. Using Trybe? Contact us about the CallPad Trybe integration. No CallPad Fresha, Treatwell, Timely, Booksy or Jane App integration yet; contact us and join the waitlist.

How much does CallPad cost for a med spa?

CallPad starts from US$150 a month per location in the US, £100 in the UK, A$200 in Australia and C$190 in Canada. It's a flat rate with all minutes included, pricing for med spa groups is custom, and setup takes about 10 minutes.

Frequently asked questions

What is an AI chatbot for a med spa?

It is a chat window on your med spa's website that answers patients' questions in plain language at any hour, using your own information: treatments, consultations, hours, location, policies and how to book. The good ones hand clinical questions to your team instead of answering them.

Can a med spa chatbot give medical advice?

It shouldn't. A chatbot should not diagnose, recommend a treatment or dose, or say whether a treatment is safe for a particular person. It should explain that a provider answers those questions and offer a consultation or a callback from your team.

Does a med spa chatbot need to be HIPAA compliant?

If your med spa is a HIPAA covered entity and the chatbot creates, receives, maintains or transmits patients' protected health information for you, the vendor is generally a business associate and you need a business associate agreement (BAA). HHS lists a third-party chatbot that handles patients' health information, for example for appointment scheduling, as an example of a business associate (HHS, checked 12 Nov 2026). Ask your compliance adviser how this applies to you.

Does CallPad sign a BAA for med spas?

Yes. CallPad offers a BAA in every plan. Contact CallPad to set it up for your med spa.

Is a chatbot enough on its own for a med spa?

Usually not. Many patients still call before booking a consultation or an injectable appointment, and some text. A chatbot helps people who are already on your website; an AI receptionist answers the phone and AI texting covers messages, so no channel goes unanswered.

Can a med spa chatbot help book consultations?

It can answer the questions people ask before they book and point them to the right next step. CallPad's AI receptionist books consultations and appointments in real time into your booking system, and its AI messaging and texting covers patients who prefer to text. Ask our team how the chatbot fits your booking flow.

Can the chatbot answer in other languages?

CallPad speaks several languages. Ask our team which languages suit your med spa.

How much does CallPad cost for a med spa?

CallPad starts from US$150 a month per location in the US, £100 in the UK, A$200 in Australia and C$190 in Canada. It's a flat rate with all minutes included, pricing for med spa groups is custom, and setup takes about 10 minutes.

Talk to CallPad

Want every patient question answered, on your website, on the phone and by text, with clinical questions left to your team and a BAA in place? Contact CallPad to ask about our AI chatbot and AI receptionist for med spas, or see CallPad for groups.

Try it out

Instantly chat to your own AI assistant to explore how it can help your business.
Your digital assistant has been created!
Oops! Something went wrong while submitting the form.

Ready to get started?

Take the first step to growing your business