AI Receptionist for Med Spa & Salons: Buyer Guide

Two callers in the same ten-minute window: one wants to know if you can fit her in for a fill at 6 PM, the other is "thinking about Botox" and would like to ask a few questions before booking anything. Both calls land on the same phone line. The same AI receptionist is supposed to answer both. The vendor sales pitch said it would.

It will not, if it was set up like every page in the top of the search results recommends. Salon work and med spa work are different operations on every axis that matters to a phone agent — call length, ticket size, regulated procedure overlay, what the script is allowed to say. Bundling them under one configuration costs you both sides of the business. The other thing missing from the search results: a clear read on when a med spa is bound by HIPAA and when it isn't, what that means for choosing an AI receptionist, and what the AI should never say in a consultation call.

This guide is the buyer-side work most vendor pages skip. We are a done-for-you AI voice agents shop and have a horse in this race; the recommendations across this article are honest about when an off-the-shelf product is the right answer and when a custom build is.

The salon vs med spa split nobody draws

Most general AI-receptionist vendors run a single configuration across salons and med spas. Some of them — the ones at the top of the SERP — write blog posts that use "salon and med spa" interchangeably across three thousand words. The operations they're describing are not the same business.

Axis	Salon (hair / nails / massage / aesthetician-only)	Med spa (Botox / fillers / lasers / Rx-only / supervised)
Average call length	60–120 seconds	4–8 minutes (consultative)
Average ticket	$50–$250	$400–$3,000 (often a treatment plan)
Booking flow	Direct: pick service, pick stylist, pick time	Discovery → consult → screening → treatment booking
Regulated procedures	None (some state limits on aesthetician scope)	Yes — Rx-only injectables, medical-grade lasers, semaglutide
Who can administer	Licensed cosmetologist / esthetician	Physician, NP, PA, RN (under supervision)
Software stack	Mindbody, Boulevard, Vagaro, Square, Fresha	Zenoti, Aesthetic Record, PatientNow, Mangomint, Moxie
Pricing posture on phone	OK to quote	Range-only; final quote post-consult
Cancellation policy	Light deposit or none	Often a hard 24-hour fee, sometimes prepaid
Post-visit follow-up	SMS review request	Clinical follow-up by provider, separate from front-desk
HIPAA likelihood	Almost never	Often yes; sometimes a grey zone

A salon-tuned AI talks price quickly because that's what a salon caller wants. A med spa caller asking the same question wants context first, range-anchored numbers second, and a free consultation booking third. Run the salon script on a med spa line and you will scare consultations off in the first thirty seconds. Run the med spa script on a salon line and your loyal Tuesday-afternoon regular hangs up because she's been asked four questions to book a manicure.

If your business runs one location with both — a hair salon up front and an aesthetic-injectable room in the back, common in the U.S. — you don't need one product configured permissively. You need two flows behind one phone number, or a hard split into two numbers, or both. We'll come back to this.

What an AI receptionist actually does in each setting

On the salon side

Inbound mix is short, transactional, and high-velocity. The agent should handle: instant booking with named stylist or "first available," walk-in availability checks against the real calendar, gift-card sales, group / wedding-party intake, cancellation and reschedule, payment-link sending for deposits, SMS reminders the day before. The post-visit job is a review-request text and rebooking nudge at the right cadence (4–6 weeks for color, 2–3 weeks for nails).

On the med spa side

Inbound mix is longer, consultative, and consent-sensitive. The agent should handle: consultation booking (almost never direct treatment booking until a provider has qualified the client), pre-screen with non-clinical questions (have you had Botox before, when was your last filler, are you currently breastfeeding or pregnant, do you have allergies to lidocaine, are you on blood thinners) where the answers route the caller, not the AI. Price posture is range-only with a clear "your provider will quote the final cost during the consultation." Post-visit clinical follow-up — "is this bruise normal" — never gets answered by the AI; it gets escalated to the clinician on call.

Cross-cutting (both sides)

Both sides need missed-call recovery, no-show prevention via deposit links and reminder cadence, multi-language handling if your market warrants it (Spanish in Texas, Florida, California; Mandarin in some West Coast metros), and clean handoff when a human staff member becomes available.

The HIPAA grey zone — exactly where it bites

This is the section every other page in the top of the search results either skips or fumbles. The salon-and-medspa hybrid page that ranks at position 5 admits in their own copy that "AI solutions are NOT HIPAA compliant so we generally cannot support Medical Spas" — and continues to sell the page anyway. That confusion is widespread, so it's worth being precise.

HIPAA applies to a Covered Entity (CE) — a healthcare provider that transmits Protected Health Information electronically in connection with billing, claims, or eligibility — or to a Business Associate of one (45 CFR 160.103). It does not apply to a business merely because medical-grade work happens there. It applies based on what the business is, what data it transmits, and how.

A pure cosmetic-only salon — hair, nails, massage, facials, aesthetician-only treatments — does not transmit electronic PHI, does not bill insurance, does not write prescriptions. HIPAA does not apply. State data-privacy laws still may (California's CCPA covers any business with $25M+ revenue or processing certain data volumes; Illinois BIPA covers biometric data), but the federal HIPAA frame does not.

A med spa with a physician, NP, PA, or RN involved, where prescription-only injectables (Botox, Dysport, Jeuveau, dermal fillers, compounded semaglutide for weight loss) are administered, where electronic prescriptions are written, where electronic insurance billing happens for any portion of the practice — this is CE territory. PHI flows the moment a caller says "I'm calling about my last Botox visit with Dr. X." Names, treatment history, and clinical notes are all PHI under 45 CFR 164.

The grey middle, which is what most med spas actually live in:

• A med spa operating under a medical director's supervision, all cash, no insurance billing, no prescriptions written from the AI's flow → often not CE under federal HIPAA, but many state laws (California's CMIA, Texas Medical Records Privacy Act, Florida) impose equivalent obligations and apply regardless.
• An aesthetic dermatology practice that bills insurance for medical-skin visits and cash for cosmetic visits → CE on the medical side. The phone line is one phone line; you cannot quarantine PHI by which question gets asked.
• A day spa with a CoolSculpting or non-ablative laser device → depends on the supervision model in your state and whether anything is prescribed.

What this means for the AI receptionist:

• If you're a Covered Entity: the vendor must sign a Business Associate Agreement (BAA). PHI flows through the STT, LLM, TTS, storage, and analytics layers — every one of those subprocessors needs a BAA. We covered this end-to-end in our HIPAA guide for medical offices, including which vendors at each layer sign BAAs and through what contract path. The audit-log requirements, breach-notification timeline, and state-law overlay all transfer to the med-spa CE case unchanged.
• If you're not a CE: a BAA is not legally required, but you still want a Data Processing Agreement (DPA), an explicit no-training-on-our-data clause, US data residency option, and a defined retention/deletion policy. Treat the contract like you would HIPAA — minus the federal teeth — because your state likely puts the teeth back.
• If you're mixed: split the line. Cosmetic-only calls flow through a permissive configuration. Clinical calls flow through a BAA-covered configuration. Never let the salon-tuned agent process clinical PHI; never let the medspa-tuned agent over-quote pricing.

The page at position 5 of the SERP gave up on med spas because their AI provider doesn't sign BAAs. That's a vendor limit, not a category limit. The category supports it; you just have to pick the right vendor.

A real med spa discovery-call script

The single most expensive thirty seconds in a med spa caller's experience is the opening of a consultation call. Get it wrong — anchor on price, sound clinical, sound like a salon — and you lose a four-figure treatment plan to the practice across town. Here is a script we run in production with adjustments per client, written out so you can paste it into a vendor demo and watch them stumble.

[CALLER] Hi, I'm thinking about getting Botox. How much is it?

[AI] Hi, welcome to [Clinic Name], I'd love to help you with that.
Before I share pricing, can I ask — is this your first time considering
Botox, or have you had it before?

[CALLER] First time.

[AI] Got it. Most first-time clients book a complimentary 20-minute
consultation with one of our providers — they look at the areas you're
interested in, talk through what's realistic, and quote the exact cost
for your treatment plan. The Botox itself runs roughly $X to $Y per
treatment area in our market, but the final number really depends on
what your provider recommends after seeing you. Can I get you on the
calendar for a free consult this week?

[CALLER] OK, sure. What do you have?

[AI] We have Wednesday at 2 PM with Sarah, our nurse injector, or
Thursday at 11 AM. Which works?

[CALLER] Thursday.

[AI] Done — Thursday at 11 AM with Sarah. I'll send you a confirmation
text now with the address and a short pre-visit form. Two quick things
before you go: any chance you might be pregnant or breastfeeding?

[CALLER] No.

[AI] Perfect. And are you currently taking any blood thinners — Aspirin,
fish oil, anything like that?

[CALLER] Just fish oil.

[AI] Good to know — our provider will talk you through whether to pause
that before your visit. You're booked. See you Thursday.

What the AI did: captured intent without anchoring on a single price, framed the consultation as the next step (not the treatment), captured two soft-screen questions whose answers gate or flag the clinical handoff, and confirmed.

What the AI must never say in a med spa script:

• "You need [specific procedure]." That is diagnosis. The AI is not licensed.
• "Botox in the forehead costs exactly $X." Every face is different; quotes happen after the provider sees the patient.
• "Yes, it's safe to get filler while you're breastfeeding." That's medical advice. Hand to clinician.
• "Your friend's results will be the same as yours."
• Comparisons of one Rx-only product to another on a clinical claim — "Dysport works better than Botox for [condition]."

If your vendor's demo script can be coaxed into any of those lines with two follow-up questions, the script is not ready for a med spa.

Failure modes vendor sales decks don't mention

• The price-quote misfire. The AI tells a caller "Botox is $14 a unit" because that's a market rate. The caller arrives for the consult, the provider sees they want both glabella and forehead lines, the real quote is $560. The caller cancels feeling baited. Fix: range-only on the phone, anchor "your provider will give you the final number."
• Multi-provider routing errors. A returning client asks for "Dr. Martinez" and the AI books with "the team." The client shows up to find a different nurse injector. Trust gone in one visit. Fix: named-provider availability with a same-day-only swap rule that triggers a courtesy text the moment a swap happens.
• Salon bluntness in the medspa script. Voice agent is configured for the salon side and the medspa caller gets "yeah, we have an opening at 4, want it?" before they've finished asking what the consult covers. Lose the consult. Fix: hard split into two voice configurations behind one number, with a 30-second front-door that asks "salon services or aesthetic services?" before routing.
• Walk-in confusion. Salon caller asks for a walk-in nail appointment; AI says "we have availability tomorrow at 10" because no one synced the live in-suite presence indicator. Caller goes to the competitor down the street who picked up the same minute. Fix: presence indicator from your booking system plus a "in-the-chair" boolean per stylist.
• AI fielding clinical questions post-procedure. "Is this bruise normal?" answered by the AI is the failure mode with the worst tail risk. Always escalate to clinical staff, never reassure. Fix: explicit intent detection ("bruise," "swelling," "pain," "fever," "rash") routes to clinical line, not to FAQ.

Integrations — what software a salon or med spa actually runs

Salon-leaning practice management: Mindbody, Boulevard, Vagaro, Square Appointments, Fresha. Mindbody and Boulevard have the deepest API access; Fresha is closing the gap; Vagaro is workable. Square is calendar-only at most vendor levels.

Med-spa-leaning practice management: Zenoti (the broadest in the category), Aesthetic Record, PatientNow, Mangomint, Moxie. Zenoti and Mangomint integrate cleanly with most AI-receptionist vendors. Aesthetic Record and PatientNow are clinical-first and integration depth varies by vendor — ask for a live demo against your live calendar, not a slide.

What "integration" actually means: the AI should be able to read your calendar (do not double-book), write a new booking back, write a contact-note to the client record (so your front-desk staff knows the AI talked to her), and trigger an SMS confirmation. Anything thinner than that is not an integration — it's an export.

The vendor landscape, by category

• Vertical-built for med spa or aesthetic only: MedspAI (med-spa focused, founder-led, ~80 clients claimed), NoLo Automation (med spa), Qlient AI (beauty + spa), ahVanguard (plastic surgery + med spa).
• General AI receptionist supporting the vertical: MyAI Front Desk, Trillet, RingCentral AI Receptionist, GoodCall, Emitrr, AgentZap.
• Hybrid AI + human: My Salon Desk, Smith.ai. Hybrid is appropriate when the consultative call flow needs human warmth that current voice AI doesn't yet match. My Salon Desk openly notes they cannot serve most med spas because their AI provider isn't BAA-covered — a vendor limit, not a category limit.
• Done-for-you / custom build: TendForce and similar agencies. Appropriate when your stack is unusual (multi-location with a mixed salon/medspa overlay, custom CRM, deeper clinical EHR integration than off-the-shelf vendors support), or when you want IRS-Pub-4557-style BAA chain alignment baked in for the CE side.

Pricing landscape: $25–$200/mo for entry-tier SaaS, $200–$500/mo for mid-tier with live transfers, $2,000–$5,000 one-time plus $50–$150/mo hosting for custom builds.

How to vet a vendor in a 30-minute call

1. Make them run your real call live. Not their canned demo — a script you wrote five minutes ago that mirrors a real caller from your front desk last week. Watch the script's behavior.
2. The pregnancy test. Ask the vendor demo: "if the caller says 'I'm 12 weeks pregnant, can I get Botox,' what does the script do?" If the answer is anything other than a clean handoff to clinical, the script is not med-spa-ready.
3. The price-pressure test. Ask: "the caller insists on a specific final price right now and refuses to book a consult without one — what does the script do?" If the script gives a single number, walk away.
4. The BAA question. "Do you sign a BAA, and through which contract path? If not, what's your legal opinion on why we don't need one for our setup?" A confident no with reasoning is fine for a non-CE salon; an evasive answer is a red flag for either side.
5. Calendar depth. "What does your integration with [your booking system] read, write, and trigger?" Pin them to read + write + contact-note + SMS-trigger or pass on the integration claim.
6. Audio + transcript handling. Where does the audio live, for how long, who can access it, can we delete on demand, is training on our data opt-out by default?

FAQ

Is an AI receptionist HIPAA-compliant for a med spa? It can be, if your vendor signs a BAA and their subprocessor BAA chain is intact through every layer (telephony, ASR, LLM, TTS, storage, analytics). HIPAA-compliant is a property of a deployment, not a product. See our medical-office HIPAA guide for the full layer-by-layer walkthrough.

Can one AI receptionist handle both a salon location and a med spa location under the same brand? Yes, but not as one configuration. Run two voice configurations behind one phone number with a short front-door router ("salon services or aesthetic services?"), or split into two numbers, or both.

Will the AI handle Spanish-speaking callers? Most modern voice-AI platforms handle Spanish at production quality. Test it on a real Spanish-language call before signing — accent handling varies. Other languages (Mandarin, Vietnamese, Portuguese) vary more.

How much does this actually cost per month? Entry-tier SaaS: $25–$200/mo, often capped by call minutes. Mid-tier with live transfers: $200–$500/mo. Custom build: $2,000–$5,000 one-time plus $50–$150/mo hosting. Most med spas in the $1M–$3M revenue band land between $200 and $500/mo all-in.

Will my front-desk staff lose their jobs? Reframing: the AI handles the calls your staff currently misses — after-hours, lunch hour, when they're already on another line — plus the volume your staff hates handling (cancellations, reschedules, "what time are you open?"). Net effect for most practices is the front desk gets to focus on in-person check-in and upselling retail, which is where revenue lives anyway.

How long does setup take? For SaaS off-the-shelf: usually under a week for the salon side, two to four weeks for med spa because the script and screening logic needs work. For custom: four to eight weeks depending on integration depth and BAA-chain coverage requirements.

Closing

The two callers in the first paragraph need two different scripts on the same phone line. The vendor at the top of the search results doesn't know that yet; the vendor at position 5 admits they can't serve half your business. The work for a med spa or salon operator is to draw the line clearly — salon vs medspa operations, CE vs non-CE on the HIPAA side, range-only vs final-quote on the pricing side — and then pick the vendor whose product actually maps to that line.

We build voice agents for spa and medspa operators when the standard product doesn't fit the location mix or the regulatory posture. For straightforward single-mode setups, the SaaS vendors named above are honestly cheaper, and we'll tell you so on the first call.