By Alpit Patel and the aibrevo team · October 15, 2026 · 13 min read
Med Spa Text Message Templates Without PHI: 12 You Can Adapt
These 12 med spa text message templates keep treatment and health detail out of the message and put the details behind a secure link or a call. Each one says why it is PHI-light, which merge fields to avoid, and which consent it needs. They are labeled templates to adapt, not legal advice.
Part of the guide: GoHighLevel for med spas
Key takeaways
- A PHI-light text names the business, a time, and an action. It leaves out the treatment, the provider's specialty, the reason for the visit and any result. HHS's own examples for voicemail suggest only a name, a number and what is needed to confirm an appointment.
- The biggest leak is not the words you type. It is the merge field. Any field that pulls in a service name, a product, a last-treatment date or a tag turns a generic template into one that names a treatment for every client.
- Consent depends on the message, not on HIPAA. Under 47 CFR 64.1200, an informational text to a wireless number needs prior express consent, and a text that includes or introduces an advertisement needs prior express written consent.
- Whether HIPAA applies to your spa at all depends on the covered-entity test. If it does not, these templates still protect clients; if it does, they reduce what you must safeguard.
- Every template here is labeled to adapt. Have your attorney review your final wording and your consent language before you send.
The problem this page solves: a med spa front desk needs text message templates it can send today that do not name a treatment, do not leak health detail (PHI) through a merge field, and do not get the spa in trouble over consent. Below are 12 labeled templates by situation. Each one says why it is PHI-light, which merge fields to avoid, and which consent type it needs. They are templates to adapt, not legal advice, and none has been reviewed by an attorney. Whether HIPAA covers your spa at all is a separate question answered in are med spas covered by HIPAA.
What makes a med spa text message PHI-light?
A PHI-light text identifies the business and the time, and asks for one action. It leaves out what the visit is for. HHS’s published example for phone messages is to leave “only its name and number and other information necessary to confirm an appointment, or ask the individual to call back” (HHS FAQ 198). Its FAQ on email adds that providers may communicate electronically “provided they apply reasonable safeguards,” such as “limiting the amount or type of information disclosed” (HHS FAQ 570). The pages we opened for this guide do not address text messages by name, so applying that limit to SMS is an inference from HHS’s principle, not an HHS rule.
Use this test before saving any template: if a coworker read it over the client’s shoulder, would they learn what treatment the client is getting? If yes, move that detail behind a secure link or a phone call.
| Keep in the text | Move behind a link or a call |
|---|---|
| Business name | Treatment or product name |
| Date and time | Reason for the visit or the area treated |
| Location or address | Dose, units, results, photos |
| First name only | Provider specialty or credentials tied to a condition |
| One action: reply, confirm, tap a link | Amounts owed, plan contents, balances |
| A way to opt out | Any clinical question or answer |
Which merge fields should a med spa never put in a text?
Any field that could contain a service, a product, a result or a history. A template is only as private as the data it pulls in. On most platforms the risky fields are the ones filled in automatically from a calendar, a form or a tag, because the person who writes the template does not see what gets inserted.
| Merge field type | Why it leaks | Safer replacement |
|---|---|---|
| Appointment or calendar title | Often holds the service name, for example the treatment booked | Use a generic calendar name such as Consultation Visit, or omit the title and send only date and time |
| Service, product or treatment custom field | Names the treatment for every client | Leave it out of SMS; show it on the secure page |
| Last treatment or treatment date field | Implies history and gives a cadence | Use a plain rebooking message with no history |
| Tags, pipeline stage, lead source | Can name a concern or a campaign about one | Never insert tags into message text |
| Provider name with title or specialty | Can imply a condition | Use the first name only, or the business name |
| Balance, amount, plan name | Payment for care is health information in many contexts | Say a payment needs attention and send a link |
| Form answers, intake fields | Collected health details | Never merge form answers into an SMS |
| Free-text notes | Unpredictable content | Never merge notes into an SMS |
In GoHighLevel these values come from contact fields, custom fields, custom values and calendar or form data, so audit each one before you map it into a message. Judgment: the calendar title is the field most often forgotten, because whoever names the calendar rarely thinks of it as message content. Rename it first.
Test every template by sending it to a test contact with a made-up treatment, tag and note, and check that none of them appears in the delivered text.
What consent does each type of med spa text need?
Consent is set by the type of message, and the rule is the same whether or not you are a HIPAA covered entity. The FCC rule at 47 CFR 64.1200, which implements the TCPA, says no person may initiate a call using an automatic telephone dialing system or an artificial or prerecorded voice to a wireless number without “the prior express consent of the called party,” and that a call that “includes or introduces an advertisement or constitutes telemarketing” needs “the prior express written consent of the called party.” The rule text treats text messages as calls: its revocation paragraph refers to “calls or text messages.” Prior express written consent is “an agreement, in writing, bearing the signature of the person called” that includes a clear disclosure that the person is not required to sign as a condition of buying anything, and an electronic signature counts.
That gives three working categories, which the templates below use:
| Consent label | When to use | What to capture |
|---|---|---|
| Informational consent (prior express consent) | Replies to an inquiry, confirmations, reminders, reschedules, billing notices, care check-ins | The client gave their number and agreed to receive texts about their appointments and account |
| Marketing consent (prior express written consent) | Anything that includes or introduces an advertisement: promotions, rebooking offers, memberships pitches, event invites | A signed or e-signed agreement with the required disclosures, separate from the informational consent |
| Conservative: treat as marketing | Review requests and rebooking nudges, where counsel may read the message as encouraging a purchase | Get marketing consent before sending |
The rule also contains a carve-out for a “health care” message from a HIPAA covered entity or its business associate. Whether your spa qualifies depends on the covered-entity test, so do not rely on it without counsel. Wording for the opt-in itself is covered in GoHighLevel TCPA setup: consent, STOP handling and quiet hours and the wording examples for med spas are in med spa text opt-in language examples. The split between appointment and marketing consent is explained at appointment vs marketing texts consent.
Add STOP handling to every template. The rule says a reply of stop, quit, end, revoke, opt out, cancel or unsubscribe is a reasonable revocation, and other clear words must be treated as one if a reasonable person would understand them that way.
12 med spa text message templates by situation
Square brackets are placeholders. Map them to your platform’s fields only after checking what each field contains. Each template is labeled TEMPLATE TO ADAPT.
1. Inquiry reply (web form or ad lead)
TEMPLATE TO ADAPT
Hi [First name], thanks for contacting [Business name]. We can help you book a time. Reply with a day that works, or tap [booking link]. Reply STOP to opt out.
- Why it is PHI-light: it confirms contact and offers a booking link. It does not repeat what they asked about, even if the form listed a service.
- Avoid: the form’s service or concern field, the ad name, any lead tag.
- Consent: informational, captured by the form. If the form is the only consent and it was for marketing, still keep the reply free of promotion. Add a promotion and it becomes marketing.
2. Missed-call text-back
TEMPLATE TO ADAPT
Hi, this is [Business name]. Sorry we missed your call. Reply here or call us at [business line] and we will get back to you today. Reply STOP to opt out.
- Why: it does not assume why they called. The caller may be a client, and a text to a number you do not know should reveal nothing.
- Avoid: matching the number to a contact and inserting a name or treatment. If the number is unknown, use no name.
- Consent: informational; a person who calls the business and is texted back about that call is a consent question for counsel, so see the setup in GoHighLevel missed-call text-back.
3. Consultation confirmation
TEMPLATE TO ADAPT
Hi [First name], you are booked at [Business name] on [date] at [time]. Address: [location]. To change it, reply or tap [reschedule link]. Reply STOP to opt out.
- Why: date, time and place only. It says nothing about the reason for the booking.
- Avoid: appointment title, service name, provider specialty.
- Consent: informational.
4. Reminder, 48 hours before
TEMPLATE TO ADAPT
Reminder from [Business name]: you have a visit on [date] at [time]. Reply C to confirm or R to reschedule. Reply STOP to opt out.
- Why: HHS says appointment reminders are part of treatment and can go out without authorization (FAQ 286), and its message guidance is to limit what is disclosed.
- Avoid: the calendar title and any prep instructions that name a treatment, such as avoiding a product before a named service.
- Consent: informational.
5. Secure link for forms and pre-visit instructions
TEMPLATE TO ADAPT
Hi [First name], your forms for [date] are ready at [secure link]. Please finish before your visit. Questions? Call [business line]. Reply STOP to opt out.
- Why: the text carries no health detail. The link goes to a page that asks for it. Form storage and consent paperwork are covered in GoHighLevel consent forms for med spas.
- Avoid: form names that include the treatment, such as a filler consent form title, and any merged answers.
- Consent: informational.
6. Reschedule request from the client
TEMPLATE TO ADAPT
Thanks, [First name]. We can move your visit. Pick a new time here: [reschedule link]. Reply STOP to opt out.
- Why: it acts on the client’s own request and reveals nothing.
- Avoid: restating the old appointment details beyond what the link shows.
- Consent: informational.
7. No-show follow-up
TEMPLATE TO ADAPT
Hi [First name], we missed you today at [Business name]. We would be happy to find a new time: [booking link]. Reply STOP to opt out.
- Why: it does not mention the treatment, the fee or the policy. Fee notices belong on a secure page, and see no-show deposits and cancellation fees for the policy side.
- Avoid: fee amounts, the service, and any guilt-trip wording.
- Consent: informational. Adding an offer to come back turns it into marketing.
8. Membership payment did not go through
TEMPLATE TO ADAPT
Hi [First name], a payment on your [Business name] account needs attention. Update it here: [secure payment link]. Questions? Call [business line]. Reply STOP to opt out.
- Why: it names an account issue, not a plan, a treatment or an amount. Payment for care can be health information, so the amount stays on the secure page.
- Avoid: plan name, monthly amount, balance, treatment names. See billing med spa memberships in GoHighLevel.
- Consent: informational (transactional). Do not add a promotion.
9. Post-visit check-in
TEMPLATE TO ADAPT
Hi [First name], this is [Business name] checking in after your visit. If you have a question, call us at [business line]. Reply STOP to opt out.
- Why: it sends the client to a call for anything clinical. It does not ask how a treatment area looks or feels.
- Avoid: aftercare instructions, treatment names, symptom questions. For fuller follow-up sequences see aftercare and follow-up text sequences.
- Consent: informational.
10. Review request
TEMPLATE TO ADAPT
Hi [First name], thank you for visiting [Business name]. If you have a minute, you can share your experience here: [review link]. Reply STOP to opt out.
- Why: it does not say what the visit was for, because a review request that names a treatment ties a person to care and could prompt them to repeat it in public.
- Avoid: the treatment, the provider’s specialty, any offer or reward. Review rules for ads and testimonials are covered in med spa text and ad compliance.
- Consent: conservative approach is marketing consent. Plain informational consent may be enough on counsel’s advice.
11. Rebooking nudge
TEMPLATE TO ADAPT
Hi [First name], it has been a while since your last visit to [Business name]. Book your next time here: [booking link]. Reply STOP to opt out.
- Why: it uses a generic interval and does not name or imply a treatment. Compare with the lapsed-client approach in lapsed patient reactivation.
- Avoid: last treatment, treatment cadence, “time for your next [treatment]”.
- Consent: marketing (prior express written consent). If your spa is HIPAA covered, marketing also touches the rule at 45 CFR 164.501, so have counsel draw the line between a treatment reminder and a promotion.
12. Reply when a client texts a clinical question or photo
TEMPLATE TO ADAPT
Thanks for reaching out, [First name]. For your safety we cannot answer health questions by text. Please call [business line] now, and we will connect you with a clinician. If this is an emergency, call 911.
- Why: it stops the clinical exchange from happening in a CRM thread.
- Avoid: giving advice, naming a treatment, asking for a photo, or storing the photo in a contact note. Keep photos and clinical notes in the charting system.
- Consent: informational reply to an inbound message. Internal routing is your policy: assign a human, log the thread, and review who may view it.
Which of the 12 templates are marketing and need written consent?
Only the rebooking nudge for certain, and the review request if you take the conservative view. Everything else is informational as long as it contains no offer. The moment you add a discount, a package, a new treatment or an event to any of them, it is an advertisement and the consent changes.
Counts are the author’s classification of the templates above under 47 CFR 64.1200, not a legal opinion. Checked 2026-10-15.
What else has to be right before these texts go out?
Four things sit outside the wording.
- Registration. US texts from a standard local number need A2P 10DLC registration, and your sample messages should match what you send. Plain templates like these are easier to describe. See GoHighLevel A2P registration for med spas and why registrations get rejected.
- Quiet hours. The FCC rule bars telephone solicitations to residential subscribers before 8 a.m. or after 9 p.m. local time. Set a send window in your workflow anyway for every template.
- The HIPAA question. If your spa is a covered entity, the platform needs its business associate agreement before protected health information is sent. The GoHighLevel side and the order of setup are covered there. These templates reduce what your texts carry; they do not replace that setup.
- State law. Some states regulate texting and health information beyond federal rules. Ask your attorney, and see GoHighLevel for med spas for where the platform fits next to booking software.
If you want these built into a working account with the right fields mapped and tested, the GoHighLevel setup for med spas page shows what a build covers, or talk to aibrevo.
Founder’s note, Alpit Patel. I see reminder texts leak a treatment name through a merge field more often than owners expect. Check what each merge field can contain before you reuse any template. A field filled in from a calendar, form or tag can drop in a service or history the template writer never sees. Keep reminders to the business name, the time and one action. Treat any template that adds a discount, package or event as advertising, because the consent you need changes the moment an offer appears. I founded aibrevo in San Francisco in 2021, and through autoesta I have overseen 320+ GoHighLevel implementation projects across med spas, real estate, healthcare, dental, home services, SaaS and professional-services clients in the US, UK and UAE. About Alpit
Sources
All opened and checked on 2026-10-15.
- HHS FAQ 198, leaving messages for patients: limit information; name, number, confirm an appointment or ask to call back; accommodate confidential-communication requests.
- HHS FAQ 570, email with patients, published 2009-02-06: electronic communication with reasonable safeguards, limit the amount or type of information.
- HHS FAQ 286, appointment reminders, content last reviewed December 28, 2022: reminders are treatment and need no authorization.
- HHS, HIPAA Privacy Rule and Marketing, published 2009-01-07: marketing versus treatment communications. eCFR, 45 CFR 164.501: current definition of marketing.
- eCFR, 47 CFR 64.1200, current through 2026-10-13: prior express consent, prior express written consent, revocation, the 8 a.m. to 9 p.m. rule, the health care message carve-out.
- eCFR, 45 CFR 160.103: covered-entity definition, referenced for the HIPAA question.
Not verified: no HHS page opened for this guide addresses SMS by name, so the application of HHS’s message guidance to texts is inference. Whether a review request or rebooking nudge is marketing in your state is a legal question. The templates have not been legally reviewed.