Check in to see how other wellness brands are winning and thriving. Check out with the insights you need to grow yours.
Medspa CRM checklist: 25 features your platform must have
Most medspas don't lose patients because the treatments aren't good enough. They lose them because a recall campaign never fired, a lead sat unanswered for four hours, a membership credit didn't apply automatically at checkout, or a provider walked into a treatment room without knowing the patient had flagged an allergy two visits ago.
Software problems. Every one of them.
This checklist covers every CRM capability a medspa needs to run its patient relationships properly — from the moment someone discovers the practice to the recall sequence that brings them back for their fifth visit. Use it to evaluate a platform you're considering, or to audit the one you're already on.
Each item is written as a test, not a feature name. Ask your vendor to show you how it handles each scenario — not just confirm that the feature exists.
How to use this checklist
Run through it in two passes.
First pass — evaluating a new platform: mark each item as Met, Partial, or Missing based on the demo. Any item marked Missing is a gap you will work around manually, pay for with a separate tool, or simply leave unaddressed.
Second pass —auditing your current system: mark each item as Working, Workaround, or Broken. If more than three items land in Workaround or Broken, thereal cost of your current platform is higher than its monthly fee.
Section 1: Lead capture and AI response
These are the features that determine whether a new patient inquiry becomes a booking or becomes someone else's patient.
1. Multi-channel lead capture into a single pipeline
Every inquiry — website contact forms, social media DMs, missed calls, ad landing pages, referral links — should flow into one unified lead view. If your team is checking multiple inboxes or tabs to find new leads, the system is already losing some.
What to verify: Ask the vendor to show where a lead from an Instagram ad lands versus a lead from a website form. Are they in the same view? Can you see both in one place without toggling?
Zenoti capability: AI Lead Management — captures leads from every channel into a unified pipeline with AI-scored prioritization.
2. Instant AI-powered lead response (under 60 seconds, 24/7)
A prospect who submits a form at 8 p.m. and hears nothing until 9 a.m. the next morning will book with whoever responded first. AI-powered lead response sends a personalized reply, qualifies the inquiry, and offers available appointment slots automatically — without a staff member being present.
What to verify: Ask what happens to a lead that comes in at midnight on a Saturday. Does the system respond automatically? What does the response say? Can it book an appointment without a staff member?
Zenoti capability: AI Lead Management — automated follow-up via text, email, or voice with zero manual effort.
3. AI Receptionist for missed calls
Every unanswered call at a medspa is a lead that called a competitor next. An AI Receptionist responds to missed calls instantly via two-way SMS, answers common questions in the practice's brand voice, and books or waitlists the caller directly into the calendar — around the clock.
What to verify: When a call goes unanswered, does the system respond automatically via text? Can it complete a booking without staff involvement? Does it integrate with the practice calendar in real time?
Zenoti capability: AI Receptionist — handles missed calls with instant SMS, books appointments, and captures new leads into the CRM pipeline automatically.
4. Lead scoring and AI prioritization
Not every lead has the same urgency. AI-powered lead scoring surfaces the highest-intent prospects so the front desk focuses its follow-up where conversion is most likely — not on the most recent inquiry.
What to verify: Does the system score leads automatically? What signals does it use — page views, service interest, past visit history? Can you see a prioritized lead list without manually sorting?
Zenoti capability: AI Lead Management — scores and prioritizes leads based on behavior, interest, and engagement signals.
Section 2: HIPAA compliance and patient data security
These are non-negotiable. Any platform handling medspa patient data is handling protected health information under HIPAA. A vendor that cannot clearly answer these questions is a liability risk.
5. Signed Business Associate Agreement (BAA)
HIPAA requires a signed BAA with any vendor that stores or transmits protected health information. Without it, the medspa carries the full liability for any breach. The BAA is the contract that makes the vendor legally accountable for how they handle patient data.
What to verify: Ask the vendor to provide the BAA before signing any contract. If they need to escalate to find it, or if it's buried in a compliance add-on tier, treat that as a signal about how seriously they take HIPAA compliance.
Zenoti capability: Zenoti is fully HIPAA-compliant and provides a BAA as a standard part of the agreement — not as an add-on tier.
6. Encrypted storage and secure transmission of PHI
Patient intake forms, treatment notes, before-and-after photos, medication histories, and appointment records all qualify as PHI. The platform must encrypt this data at rest and in transit, maintain audit logs of who accessed what and when, and support role-based access controls.
What to verify: Ask where patient data is stored (cloud region, infrastructure provider), how it is encrypted, and what the audit log looks like. Ask to see a sample audit log.
Zenoti capability: Zenoti — HIPAA-compliant infrastructure with encrypted storage, secure transmission, and full audit logging.
7. Role-based access controls
A front-desk coordinator should not access full clinical charts. A provider should not modify billing records. Role-based access controls enforce these distinctions automatically — not through staff training and hope.
What to verify: Ask the vendor to show how permissions are set by role. Can you limit a front-desk user to booking and payment only? Can you restrict a provider to their own patient records?
Zenoti capability: Zenoti — configurable role-based permissions across Administrator, Provider, and Front Desk roles with audit tracking.
Section 3: Clinical documentation
These are the features that separate a medspa CRM from a general-purpose booking tool. If the platform cannot handle these, it is not built for a clinical environment.
8. AI-assisted clinical charting
Charting after a treatment session takes time a provider could spend with the next patient. AI-assisted charting listens to the provider-patient consultation and generates a structured clinical note automatically — covering patient details, clinical observations, interventions, next steps, and follow-up care. The provider reviews and signs; they do not transcribe.
What to verify: Ask the vendor to demo AI charting in a live session. Does it generate a complete note during the consultation? What sections does it cover? How does the provider review and amend before signing?
9. Digital consent forms and intake documentation with auto-flagging
Paper intake forms create storage problems, HIPAA risks, and front-desk bottlenecks. Digital consent forms linked to the patient's record — accessible before the appointment, signed electronically, stored automatically — eliminate all three. Critical flags from intake forms (allergies, contraindications, medications) should surface automatically in the chart before the provider enters the room.
What to verify: Can a patient complete their intake form before arrival? Does the system flag contraindications automatically? Are signed consent forms attached to the patient's record, or stored separately?
Zenoti capability: Forms and Charting — digital forms with conditional logic, DOT phrases, annotation pads, and compliance tracking; critical flags surface automatically at the chart.
10. HIPAA-compliant before-and-after photo management
Before-and-after photos are both a clinical record and a marketing asset. The platform needs guided capture for consistent framing, storage linked to the patient profile and treatment type, side-by-side comparison tools, and HIPAA-compliant access controls. Photos stored in a general cloud folder lose clinical context and create compliance gaps.
What to verify: Ask the vendor to show the photo capture flow for a consultation. Are photos automatically linked to the patient's treatment record? Can you do side-by-side comparisons? Who can access them, and is access logged?
11. Guest medical record with allergy and contraindication management
A patient's allergy flags, current medications, medical history, and critical health conditions should be visible to the provider before every appointment — and should automatically alert the provider if a planned treatment conflicts with a recorded contraindication.
What to verify: Ask the vendor to show what a provider sees when they open a patient's record before an appointment. Are allergy flags visible on the chart? Does the system alert the provider if a planned treatment conflicts with a recorded condition?
Section 4: Scheduling and front-desk operations
12. Online booking with 24/7 self-scheduling across every channel
Top-performing medspas achieved a 31% online booking rate in 2024 — nearly triple the industry average of 11%, according to the Zenoti 2025 Benchmark Report. The practices driving that number have made online booking seamless across website, mobile app, Google Business Profile, and Instagram. Patients who cannot book without calling will often not book at all.
What to verify: Can a patient complete a booking in under two minutes on a mobile device? Is real-time availability shown? Can the practice require deposits or consent acknowledgement at the time of booking?
Zenoti capability: Online Booking — 24/7 self-scheduling from website, app, Google, and social channels with real-time availability and configurable deposit requirements.
13. Automated waitlist management
Every cancellation is either a lost revenue slot or a filled one. Automated waitlist management notifies the next patient the moment a slot opens — without any manual step from the front desk. This is especially high-value where same-day cancellations are common and average appointment value is high.
What to verify: When an appointment is cancelled, what happens automatically? Is there a waitlist? Does the system notify the next patient and allow them to confirm in one tap — without front-desk involvement?
Zenoti capability: Waitlist Management — automated waitlist that fills cancelled slots with instant patient notification and one-tap confirmation.
14. No-show reduction: deposits, tiered reminders, and pre-care instructions
The average medspa saw a 16% cancellation rate in 2024, compared to a 12% industry average — Zenoti 2025 Benchmark Report. Reducing no-shows requires three layers: deposit requirements at booking (financial commitment), tiered automated reminders at 72 hours, 24 hours, and 2 hours (addressing forgetfulness), and pre-care instructions before the appointment (connecting the patient to the outcome they booked for).
What to verify: Can the practice require deposits for specific services? How many reminder touchpoints does the system support, and are they configurable by service type? Are pre-care instructions sent automatically and linked to the specific treatment booked?
Zenoti capability: Appointment Book — configurable deposits, tiered reminder sequences, and automated pre- and post-care communication tied to treatment type.
15. Abandoned cart recovery for incomplete bookings
A patient who starts the booking process and does not complete it is a warm lead — they were ready to book. Automated abandoned cart recovery sends a timely follow-up and returns them to where they left off, recovering appointments that would otherwise be invisible to the front desk.
What to verify: Does the platform track incomplete bookings? Does it follow up automatically? Can the follow-up message be personalized by service type?
Zenoti capability: Abandoned Cart Recovery — automated recovery sequences for incomplete online bookings.
Section 5: Marketing and automated patient retention
These are the features that determine whether a medspa grows its patient base or churns it. A system that cannot run retention campaigns from clinical data is a scheduling tool, not a CRM.
16. Treatment-specific recall campaigns from clinical data
A Botox patient needs a recall at three months. A laser patient on an active series needs a reminder at four to six weeks. These campaigns need to fire automatically based on the patient's actual treatment record — not a generic sequence based on days since last visit. The clinical data and the marketing tool must be in the same system.
What to verify: Can the platform trigger a recall campaign based on the specific treatment received and the recommended time window for that treatment? Does it use clinical data — not just marketing data — to drive the sequence? Does anyone need to export a list first?
17. AI-powered campaign creation and audience segmentation
Running effective campaigns manually — building the audience, writing the message, scheduling the send, tracking results — takes time most medspa teams do not have. AI-powered campaign tools automate the segmentation, personalize the outreach, and surface the patients most likely to respond before the campaign is sent.
What to verify: Can the platform suggest which patients should receive a campaign based on their behavior and treatment history? Does it personalize messages automatically? Can it identify patients at risk of churning before they stop coming?
18. Automated reputation management and review generation
After a successful treatment, a patient who leaves a five-star Google review does more for patient acquisition than any paid ad. Automated review requests — sent at the right moment after the appointment — generate a steady volume of organic reviews without any manual effort. Negative feedback should route internally for resolution before reaching a public platform.
What to verify: Does the platform send review requests automatically after appointments? Can the timing and channel be configured? Does it route negative feedback internally before it reaches Google or Yelp?
Zenoti capability: Automated Reputation Management — automated review requests, AI-suggested responses, and internal routing of negative feedback.
"Smart marketing has been a real game changer for our brand. Due to the implications of COVID-19 and the related shutdowns, it was imperative we get customers back into the salon and generate revenue as fast as possible. With Zenoti it was quick and easy to implement, and most importantly, successful. Most software can't handle one targeted marketing campaign, let alone 12."
— Zeefah Ali, Regional Manager, Trifecta Medspa — 260 guests recovered, 30% revenue influenced by campaigns, 30x ROI on Zenoti investment
Section 6: Memberships, packages, and revenue management
19. Membership and package management at the point of sale
A membership program in a separate billing system creates checkout friction, reconciliation errors, and patient confusion. Credits should apply automatically at checkout from the patient's own record. The front desk should never need to check a spreadsheet or call a manager to confirm a patient's membership balance.
What to verify: Show a checkout for a membership patient. Does the credit apply automatically? Can a patient redeem at any location in the practice group? What does the front desk see if a membership has expired or credits are insufficient?
Zenoti capability: Memberships and Packages — recurring billing, beauty bank credits, loyalty points, and package balances all resolve automatically at POS from the patient's unified record.
20. Injectable and consumable inventory tracking linked to charting
Injectables, filler units, laser tips, and IV bags represent significant per-treatment COGS. Tracking them separately from the chart creates shrinkage, waste, and inaccurate COGS reporting. Inventory should auto-deduct at the point of charting, with batch and expiry tracking for every injectable unit.
What to verify: When a provider charts a Botox treatment, does the system automatically deduct the units from inventory? Can it track by batch and lot number? Does it flag approaching expiry dates before waste occurs?
Zenoti capability: Inventory Management — auto-consumption at charting, batch and expiry tracking, COGS reporting, and near-expiry alerts.
21. Dynamic pricing for peak demand and premium providers
Static pricing leaves revenue on the table during high-demand windows. A platform supporting dynamic pricing adjusts service prices automatically during peak hours or for premium providers — capturing the full value of the schedule without any manual price change.
What to verify: Can the platform apply different pricing rules based on time of day, day of week, or provider level? Does the updated price reflect automatically in the webstore, kiosk, and front-desk view without staff intervention?
Zenoti capability: Dynamic Pricing — AI-driven price adjustment based on real-time demand, with instant reflection across all booking surfaces.
22. Loyalty programs linked to patient activity
Loyalty programs that run separately from the booking system are invisible to staff at checkout. A loyalty program embedded in the patient record — where points accumulate automatically with every visit and redemption happens at the same POS — creates genuine retention without administrative overhead.
What to verify: Does the loyalty program track automatically with every visit? Can patients redeem at checkout without any staff input? Are points visible on the patient profile before the appointment starts?
Zenoti capability: Loyalty Programs — integrated loyalty with automatic point accumulation, referral rewards, and redemption at checkout.
Section 7: Reporting, analytics, and the AI business advisor
23. Cross-location reporting and industry benchmarking
A practice with more than one location needs ownership-level visibility without pulling manual exports from each site. The system should aggregate revenue, provider utilization, membership conversion, and retention metrics across all locations in one dashboard — and ideally benchmark those metrics against industry data.
What to verify: Can the owner see revenue and retention metrics for all locations in one view? Does it require any manual export or consolidation step? Does the platform provide any benchmarking against industry averages?
Zenoti capability: Business Intelligence — real-time reporting across all locations with performance dashboards and benchmarking against the Zenoti network of 30,000+ businesses.
24. AI business advisor (conversational analytics)
A platform that generates data is useful. A platform that tells the owner what to do with it is transformative. An AI business assistant integrated directly into the platform can answer natural-language questions about practice performance, surface trends without requiring the owner to build custom reports, and recommend specific actions to fill slow days or re-engage at-risk patients.
What to verify: Can the owner ask the platform a performance question in plain language and get an immediate answer? Can it recommend actions — not just surface data? Does it require training to use?
Zenoti capability: Zeenie — AI-powered business assistant that answers performance questions, automates tasks, visualizes trends, and guides staff without requiring manual reports.
Section 8: Staff and operational tools
25. Provider scheduling with licensing and service restrictions
A booking system that does not enforce provider licensing restrictions allows scheduling errors that create compliance and liability exposure — a nurse injector booked for a facial, an esthetician booked for an injectable procedure. The platform should restrict services to eligible providers automatically at the booking level.
What to verify: If an esthetician is not licensed to administer injectables, does the system prevent a patient from booking an injectable appointment with that provider? Is this enforced at the booking stage, not just at checkout?
Zenoti capability: Appointment Book — provider scheduling with configurable service restrictions enforced at the booking stage.
26. Staff performance tracking and integrated commission management
Provider productivity, rebooking rates, retail attachment, upsell rates, and tip performance are the leading indicators of practice health. A platform that tracks these per-provider — and lets staff see their own metrics — creates accountability without requiring a manager to pull reports. Integrated payroll and commission calculation removes an entire category of administrative work.
What to verify: Can the platform show revenue per provider, rebooking rate per provider, and upsell conversion per provider in one view? Is payroll calculated automatically from appointment data without manual spreadsheet work?
Zenoti capability: Employee Performance Management — unified staff dashboard with productivity metrics, performance tracking, and integrated payroll calculation.
27. Mobile app for providers (schedule, charts, and payments on device)
Providers who can access their schedule, patient history, and charts from a mobile device before entering the treatment room are better prepared and less dependent on the front desk. A native provider app — not just a mobile-optimized web version — allows charting, payment collection, and schedule management from anywhere in the clinic.
What to verify: Does the platform have a native mobile app for providers? Can a provider see their full schedule, patient history, and chart notes from their phone before walking into a treatment room? Can they complete a checkout from the treatment room?
Zenoti capability: Zenoti Mobile App and MyZen Provider App — native mobile access for schedule management, patient profiles, charting, and performance metrics.
The scoring guide
After running through all 27 items, tally the results:
| 22–25 items Met | Platform is purpose-built for medspa operations. Remaining gaps are edge cases. |
|---|---|
| 16–21 items Met | Covers the core, but has meaningful gaps — likely in clinical documentation or marketing automation. Calculate the workaround cost. |
| Under 16 Met | Platform was not built for a medspa's full operational complexity. Total cost of missing items — in staff time, subscriptions, and lost revenue — likely exceeds the cost of a purpose-built alternative. |
A note on the checklist approach
Zeefah Ali at Trifecta Medspa identified the real standard during a case study on marketing automation: "Most software can't handle one targeted marketing campaign, let alone 12." The same principle applies to every section of this checklist. A platform that can handle one capability in isolation is not the same as a platform where all 27 capabilities run from the same patient record — where the lead becomes a patient, the patient's chart drives the recall campaign, the recall converts back to a booked appointment, that appointment auto-deducts from inventory, feeds the commission calculation, and updates the cross-location dashboard.
That is what a purpose-built medspa CRM does. Each capability on this checklist is worth evaluating individually. The platform that earns the most marks is the one where they are all connected.
FAQs
What features should a medspa CRM have?
A medspa CRM must cover five core areas: lead capture and AI-powered follow-up so no inquiry goes unanswered; HIPAA-compliant patient data storage with a signed BAA; clinical documentation including charting, consent forms, and photo management; automated retention campaigns built from clinical data; and membership and package management at the point of sale. Platforms built specifically for the medspa vertical cover all five natively. General-purpose CRMs typically cover one or two with workarounds.
Is there a checklist for medspa CRM features?
This checklist covers 27 specific capabilities across eight categories: lead capture and AI response, HIPAA compliance, clinical documentation, scheduling, marketing and retention, memberships and revenue, reporting and AI, and staff management. Each item is written as a verifiable scenario to test with any vendor during a demo — not just a feature name to confirm.
What is the difference between a medspa CRM and a medspa EMR?
An EMR stores and manages clinical documentation — treatment notes, intake forms, allergy records, before-and-after photos. A CRM manages the patient relationship before and after the clinical visit — lead capture, marketing campaigns, retention sequences, loyalty programs. The most operationally efficient medspa platforms combine both in a single patient record, so clinical data drives marketing and marketing feeds back into the clinical workflow without any manual data transfer between systems.
Does a medspa CRM need to be HIPAA compliant?
Yes. Any platform that stores, transmits, or processes protected health information — including patient intake forms, treatment notes, appointment records, before-and-after photos, and medication histories — must comply with HIPAA and provide a signed Business Associate Agreement. Verify the BAA directly with any vendor before committing.
What CRM features are most important for a single-location medspa?
For a single-location medspa, the highest-impact capabilities are: AI-powered lead response so no inquiry waits overnight; automated treatment-specific recall campaigns so retention runs without manual effort; HIPAA-compliant charting in the same system as booking so the provider has full context before every appointment; and membership management at POS so checkout is clean and credits apply automatically. These four capabilities — combined in one system — eliminate the most common sources of revenue loss at practices of any size.
How do I evaluate a medspa CRM?
Use this checklist as a demo script. For each item, ask the vendor to show you the scenario in a live system — not just confirm the feature exists. Pay particular attention to items in the clinical documentation and marketing automation sections, as these are where the largest gaps appear between general-purpose tools and purpose-built medspa platforms. Score each item as Met, Partial, or Missing, then use the scoring guide at the end of this checklist to interpret the results.
Sources
- Zenoti 2025 Beauty and Wellness Benchmark Report — online booking rate, cancellation rate, staff utilization benchmarks [Zenoti own research]
- American Med Spa Association (AmSpa) — medical aesthetics market data [independent industry association]
- Trifecta Medspa — Zeefah Ali, Regional Manager [Case Study, cleared for external use]
A note on transparency: The Check-In is powered by Zenoti, which appears throughout this guide. Zenoti platform links are included because this checklist is designed to show how a purpose-built medspa platform handles each requirement — not as a paid promotion.
Written by
Cheryl Cole, Managing Editor
Cheryl uses her background in journalism to help brands bring their unique stories to life. Passionate about content strategy, she has extensive experience leading both print and digital publications. As managing editor of The Check-In, Cheryl is committed to providing wellness professionals with high-quality, tailored content designed to help grow their brands.
Learn more about Cheryl Cole