By Alpit Patel and the aibrevo team · October 15, 2026 · 8 min read
How to Audit a Med Spa GoHighLevel Account: 10 Checks and Where to Find Them
To audit a med spa GoHighLevel account, run ten checks in order: text registration, consent, workflows, reminder timing, calendars, email domain, patient detail in templates, user access, pipeline structure and missed-call replies. Each check below names the menu location, the symptom it explains and the fix.
Part of the guide: GoHighLevel audit and fix for med spas
Key takeaways
- Test every check with a fresh test contact. A settings screen can look correct while the message still fails, so each check ends with an action you can run.
- Order matters: fix text registration and consent first, because a perfect reminder workflow cannot reach a client whose number is not registered or who opted out.
- Appointment triggers have documented limits: Customer Booked Appointment does not fire for appointments your team books by hand, and appointment triggers always allow re-entry for each new appointment.
- A reminder at the wrong hour is usually a time zone setting. HighLevel lets a workflow run on the account time zone or each contact's, and contacts with no time zone fall back to the account's.
- Whether your med spa is a HIPAA covered entity is a legal question. The audit checks configuration and flags what to ask a healthcare attorney.
You can audit a med spa GoHighLevel account in an afternoon if you do it in the right order and test as you go. This guide gives ten checks, the menu location for each, the symptom each one explains and the fix. It assumes you have admin access and three test contacts that use your own phone numbers and email addresses.
If you would rather have it done and documented, that is the GoHighLevel audit and fix for med spas service, part of aibrevo’s GoHighLevel expert for med spas guide. For a quick score first, run the free account health check.
How do you audit a med spa GoHighLevel account, and where does each check live?
The table is the whole audit on one screen. Work top to bottom. Menu names are from HighLevel’s help center; labels can change between releases, so confirm in your own account.
| # | Check | Where to look | Symptom it explains |
|---|---|---|---|
| 1 | Text registration and number status | Settings, Phone System, Trust Center; Settings, Phone System, Phone Numbers | Texts fail or never arrive |
| 2 | Consent and opt-out | Your forms and the contact’s DND setting | Opt-outs ignored, or clients texted who never agreed |
| 3 | Workflow inventory | Automation, Workflows | Messages sent twice, or nothing sent |
| 4 | Reminder timing and time zones | Workflow Settings tab; Settings, Business Profile | Reminders at the wrong hour |
| 5 | Calendars and booking triggers | Calendars; the appointment trigger in each workflow | Staff-booked clients get no reminder |
| 6 | Email sending domain | Settings, Email Services, Sending Domain | Email in spam or bouncing |
| 7 | Patient detail in templates and forms | Each template, form and survey | Treatment wording in texts or public forms |
| 8 | User access | Settings, My Staff (labeled Users in some versions) | Too many admins, or former staff still active |
| 9 | Pipeline, fields, tags and custom values | Opportunities, Pipelines; Settings, Custom Fields; Settings, Custom Values | Leads stuck, wrong prices or links in messages |
| 10 | Missed-call and new-lead replies | A real call and a real form submission | Leads go cold before anyone answers |
Check 1: can your texts be delivered?
Open Settings, Phone System, Trust Center and confirm the US business texting registration is approved, then open Settings, Phone System, Phone Numbers and look for the green A2P Verified label on each sending number. Our A2P registration steps walk through the Trust Center, and SMS error codes explain each failure code. Test: text your own phone and a phone on another carrier, then read the status on each message.
| Symptom | Likely cause | Fix |
|---|---|---|
| Failed status with a code | Number not linked to an approved campaign, content filtered, or recipient opted out | Read the code in the SMS error guide, fix the cause, then resend |
| Registration rejected | Opt-in wording or website does not match the submission | Align form, website and campaign text, then resubmit |
| Shows sent, never arrives | Carrier filtering | Test on several carriers, review message content |
Check 2: are consent and opt-out working?
Submit your own form and confirm the wording on it covers the texts you send. Reply STOP from your test phone and confirm the contact stops receiving messages. The rules are in the TCPA consent and opt-out setup guide. Treatment consent forms are a separate subject and the med spa cluster covers them in its own guides. Texting rules and state rules differ, so ask a healthcare attorney about yours.
Check 3: what is every workflow doing?
Open Automation, then Workflows. For each workflow write down the status, trigger, last run and purpose. A workflow in draft will not fire from live triggers. Open a test contact’s Enrollment History and Execution Logs to see what ran, what was skipped and why. If two workflows share a trigger and send the same message, that is the cause of doubles, covered in duplicate messages. If a workflow never starts, use workflow not triggering.
Check 4: do reminders go out at the right hour?
Open the workflow, then its Settings tab. HighLevel’s Workflow Settings overview says the Timezone dropdown applies to all time-dependent steps and can be Account Timezone or Contact Timezone, with the account time zone as the fallback for contacts that have none. The Time Window pauses texts and emails sent outside your hours and resumes them at the next available slot. Then open Settings, Business Profile and read the Time Zone field. The full fix guide is reminders at the wrong time zone. Test: create a contact set to another time zone, book it, and read the scheduled send times.
Check 5: does the right trigger start each workflow?
Open each appointment workflow and read the trigger. HighLevel’s documentation says Customer Booked Appointment fires when a client books through a booking link and does not fire for appointments your team creates manually. The Appointment Status trigger covers status changes, including staff bookings. If your front desk books by phone, a reminder workflow built on the first trigger will skip those clients. Test: book one appointment as a client and one as staff, then compare. The build is in the appointment reminder and no-show workflow guide. If an outside calendar disagrees with GoHighLevel, use Google Calendar not syncing.
Check 6: is email authenticated?
Open Settings, Email Services, Sending Domain. HighLevel’s authentication guidance has you add the domain, copy the DNS records it generates and click Verify Domain until the checks show Verified. Send a test to a real mailbox, check the spam folder and read the headers. The method is in the SPF, DKIM and DMARC guide.
Check 7: what patient detail sits in messages and forms?
Read every template, form and survey. Reminders need a time, a place and a way to reach you. They do not need a treatment name, a dose or a health answer. Public landing-page forms should not ask for health detail. If you decided HIPAA settings apply to you, confirm the add-on, the signed BAA and the per-sub-account switch are done, using the HIPAA setup steps. Whether a cash-pay med spa is a covered entity is a legal question for a healthcare attorney. See is GoHighLevel HIPAA compliant and our med spa overview.
Check 8: who can do what?
Open Settings, My Staff, which some HighLevel articles say is being renamed Users. For each person confirm the role (Admin or User), the modules they can reach and whether Only Assigned Data is on. Remove anyone who left. Our roles and permissions guide explains each setting.
Check 9: do the pipeline, fields and custom values match the business?
Move a test contact through the pipeline you actually run, under Opportunities, Pipelines. Then open Settings, Custom Fields and Settings, Custom Values and look for fields nobody uses, duplicates, and old prices or links still stored in templates. The custom values guide shows how to store business details once. A pipeline built for a menu you no longer sell is a rebuild signal.
Check 10: does a new lead or missed call get a fast reply?
Call each business number from a phone that is not saved as a contact, let it ring out, and submit your own web form. Time how long each takes to produce a text. See missed-call text-back not working if nothing arrives.
How do you rank what you found?
Rank by what each fault costs you today. A dead text registration blocks everything, so it comes first. Then faults that reach clients (wrong-hour reminders, doubles), then risks (access, patient detail), then tidiness. For each item write: symptom, cause, fix, who does it and any waiting period, such as a registration review. If several faults come from one structural problem, or nobody can explain most workflows, read fix or rebuild before changing anything.
When should you bring in an expert?
Bring one in when the faults connect (three workflows touching the same tag), when you cannot reproduce a problem with a test contact, or when a fix could affect live clients and data. aibrevo’s med spa audit and fix service covers the same ground. The audit is free: book a free 30-minute call and we go through your account with you. Fix work is scoped and quoted in writing. aibrevo works with its partner company autoesta, whose team delivers GoHighLevel builds. The general service page is GoHighLevel audit and fix service.
Founder’s note, Alpit Patel. I see accounts where a good workflow reaches nobody because texting was never registered. Fix text registration and consent before anything else. A perfect reminder workflow cannot reach a client whose number is not registered or who has opted out. Then test every check from your own phone, as a client would. Execution Logs show that an action ran. They do not show that a carrier delivered it. I founded aibrevo in San Francisco in 2021, and through autoesta I have overseen 320+ GoHighLevel implementation projects across med spas, real estate, healthcare, dental, home services, SaaS and professional-services clients in the US, UK and UAE. About Alpit
Sources
All checked 2026-10-15.
- HighLevel Support, Workflow Settings overview: Timezone, Time Window, Allow Re-entry (appointment triggers always allow re-entry). No modified date shown.
- HighLevel Support, Customer Booked Appointment trigger: manual bookings do not fire it. Modified April 6, 2026 per our earlier read on 2026-10-13.
- HighLevel Support, Email Authentication Errors: Settings, Email Services, Sending Domain path, seen in a search summary on 2026-10-15; the page itself was not opened. Menu labels vary by version.
- HighLevel Support, Sub-account user roles and permissions: Settings, My Staff, roles, Only Assigned Data, and the rename to Users, seen in a search summary on 2026-10-15; the page was not opened.
- Trust Center and Phone Numbers paths are as documented in our A2P registration steps, which cite HighLevel’s registration article (checked 2026-10-13).
- Not verified: Settings, Custom Fields and Custom Values paths and the Opportunities, Pipelines path were taken from our own existing guides, not re-opened today.