Med Spa GoHighLevel Handoff Checklist: What to Collect Before You Sign Off

A GoHighLevel build is finished when your front desk can run it without the builder. The handoff is where that gets settled. This med spa GoHighLevel handoff checklist gives 24 items to collect from your builder, grouped by what each protects, so you can check the work yourself.

It is the closing step of the vetting process in our guide to choosing a GoHighLevel expert for a med spa, where the contract clauses ask for this handoff. The GoHighLevel expert for med spas page explains what the build itself includes.

What should be on a med spa GoHighLevel handoff checklist?

A med spa handoff checklist covers eight areas: ownership and users, compliance records, texting registration and numbers, email domain, integrations, workflow documentation, test evidence and support. You should be able to see each item below for yourself.

Area	Items to collect	Why a med spa cares
1. Ownership and users	Written confirmation of the agency owner of record; user list with role and MFA status; two named admins on your side; removal of any shared logins	Your exit options depend on who holds the agency account
2. Compliance records	If HIPAA applies: where the signed BAA is stored and who signed it; HIPAA setting status per sub-account; counsel’s written HIPAA position on file	The add-on is permanent and the practice, not the builder, is the covered entity
3. Texting and numbers	A2P brand and campaign registration records; the campaign description and sample messages as submitted; phone number list and provider (LC Phone or Twilio)	A rejected or mismatched registration gets texts filtered
4. Email domain	Sending domain and the DNS records added; who controls the domain registrar	Email deliverability and your control over the domain
5. Integrations	List of every integration and connection method (Zapier, webhook or API); who holds each credential and which plan it needs	Booking-platform syncs break silently when a credential lapses
6. Workflow documentation	One page per workflow: trigger, actions, exit condition, consent field it checks; list of custom fields and tags; forms and calendars list	Staff turnover turns undocumented workflows into mysteries
7. Test evidence	Written test log listing each branch tested and the result; a recorded walkthrough	Proof the work was tested before real clients were enrolled
8. Support terms	Support period, response time for urgent faults, billable rates; who to contact	You need to know what a broken workflow costs in month three

How do I confirm account ownership and users at handoff?

Ask for written confirmation of who is the agency owner of record, then check the user list yourself. If the builder holds the agency account, agree the transfer process now, because only the agency owner, or an admin they authorize, can start a transfer.

HighLevel’s Sub-Account Transfer Guide (checked 15 October 2026) describes a transfer as moving the whole sub-account from the releasing agency to the receiving agency, with contacts, conversations and supported assets staying together. The agency owner starts it at Agency Level, Sub-Accounts, Manage Client, Actions, Transfer Sub-account, enters the receiving agency’s Relationship Number, and the receiving agency approves. The guide says to confirm that the receiving agency has the required capacity, compliance add-ons and an active account.

Checklist for this area:

1. Written statement of the agency owner of record.
2. The transfer process and timeline if the builder owns the agency.
3. A full user list with role, last login and MFA status.
4. At least two named admins from your practice.
5. No shared logins; each person has their own.

The wider sub-accounts explainer shows where agency-level settings and location-level settings live.

What compliance records should I collect?

If HIPAA applies to your practice, collect the BAA location, the HIPAA setting status for each sub-account and counsel’s written position. If it does not apply, collect that written position too, so the next person does not turn on a permanent $297 a month add-on by guesswork.

HighLevel’s HIPAA support article (checked 15 October 2026) says accounts are not HIPAA compliant by default, the add-on is $297 a month, and it cannot be canceled, refunded, removed or downgraded once enabled. It says the signed Business Associate Agreement is stored in the platform under Settings, Compliance, and the HIPAA setting for each location sits under Advanced Settings. The article describes both automatic activation after the BAA is signed and a manual per-sub-account switch, so check the toggle in your sub-account yourself.

Checklist for this area:

6. Where the signed BAA is stored and who signed it.
7. HIPAA setting status for each sub-account, checked by you.
8. Counsel’s written position on whether the practice is a covered entity.
9. A note on which tools carry client data outside HighLevel, and whether each has its own agreement.

This is general information, not legal advice. Our HIPAA answer and HIPAA setup steps give more.

What texting and phone number records do I need?

You need the A2P registration records, the campaign description and sample messages as submitted, and the phone number list with the provider. Without them, a rejected campaign or a lost number is hard to fix and impossible to move.

HighLevel’s transfer guide says that if both agencies use LC Phone, numbers transfer with the sub-account, eligible A2P registration stays with the numbers and future usage is billed to the receiving agency. If either agency uses Twilio, numbers do not transfer automatically and the move has to be coordinated with the Twilio account owner. So the question “which provider are our numbers on” is a handoff item. Our Twilio with GoHighLevel answer explains the options.

Checklist for this area:

10. A2P brand and campaign registration records and status.
11. The campaign description and sample messages exactly as submitted.
12. The opt-in wording on every form, matching the registration.
13. Phone numbers with the provider (LC Phone or Twilio) and who owns the Twilio account if there is one.

If a registration was rejected during the build, see our A2P rejection guide for what changed.

What email domain and integration records should I collect?

Collect the sending-domain DNS records and who controls the domain registrar, plus a list of every integration with its method and credential holder. These are what silently break months later.

Checklist for these areas:

14. The sending domain and the DNS records that were added.
15. Who controls the domain registrar and DNS.
16. List of every integration: booking platform, payments, calendar, forms, Zapier or webhooks.
17. The method for each (Zapier, webhook or API), and which events flow in which direction.
18. Who holds each credential and which paid plan it depends on.
19. The field-ownership map: which system owns appointment, treatment, membership and consent fields.

The field-ownership map is the most useful page in a med spa handoff. Our setup page explains why one system should own each field.

What documentation and test evidence should I get?

Get one page per workflow, a list of custom fields and tags, a written test log and a recorded walkthrough. Documentation tells staff what the account does; the test log tells you whether it ever worked.

Checklist for these areas:

20. For each workflow: trigger, actions in order, exit condition, and the consent field checked before any send.
21. A list of custom fields and tags with what each means, and a list of forms and calendars.
22. A written test log listing each workflow branch tested, the test contact used and the result.
23. A recorded walkthrough, with the screen visible, that a new staff member could follow.

What support terms should be written down?

Write down how long fixes are included, how fast urgent faults get a response and what is billable. This is the last item, and the one most often left vague.

24. The support period after go-live, the response time for urgent faults such as texts not sending, billable rates after that period, and a named contact.

Paste the answer into the contract as well as an email, so there is a clause to point to if something breaks in month three.

How do I run my own acceptance test before final payment?

Run a short test yourself from a personal phone before you sign off. It takes a couple of hours and checks the things documentation cannot.

1. Submit each live form with a test contact and confirm consent fields record correctly.
2. Reply to a reminder, then reply STOP to a promotion, and confirm what still sends.
3. Book a test consultation, trigger a no-show and a completed appointment, and watch each workflow branch.
4. Confirm the booking-platform events reach HighLevel with test data.
5. Log in as each admin and confirm MFA works.
6. Read the user list again.

If something fails, note it, send it to the builder in writing and withhold final payment until it is fixed. If you want a comparable process for an existing account that already misfires, our audit and fix for med spas page covers it. If you want us to run a handoff like this, see our GoHighLevel implementation service or contact us.

Founder’s note, Alpit Patel. I see handoffs end at the final invoice with the owner unsure what they received. Settle who holds the agency account before the build ends. Finish the handoff before the final invoice, because that is when the builder is easiest to reach. Check the HIPAA setting in each sub-account yourself. Then ask which provider your phone numbers sit on, since numbers move with a transferred sub-account only when both agencies use LC Phone. I founded aibrevo in San Francisco in 2021, and through autoesta I have overseen 320+ GoHighLevel implementation projects across med spas, real estate, healthcare, dental, home services, SaaS and professional-services clients in the US, UK and UAE. About Alpit

Sources

• HighLevel Support, Sub-Account Transfer Guide: transfer path, who can transfer, whole-sub-account behavior, LC Phone and Twilio rules, HIPAA add-on requirement. Checked 2026-10-15.
• HighLevel Support, HIPAA Compliance in HighLevel: default status, $297 a month, permanence, BAA location under Settings, Compliance, per-sub-account setting under Advanced Settings. Checked 2026-10-15.
• aibrevo, GoHighLevel setup for med spas: field ownership and booking-platform methods, checked 2026-09-30.