GoHighLevel · Pillar guide
Med Spa Consent Forms in GoHighLevel: Which Ones to Send and Where They Live
Quick answer
Med spa consent forms usually come down to five documents: treatment consent, photo and media consent, a financial policy, texting consent and a privacy notice acknowledgment. GoHighLevel can send, collect and file most of them through Forms, Surveys and Documents & Contracts, but it has no med spa consent library and no clinical chart, so the clinical ones often stay in your charting system.
Part of the guide: GoHighLevel setup for med spas
Key takeaways
- Five consent documents cover most med spas: treatment consent, photo and media consent, financial and cancellation policy, texting consent, and a privacy notice acknowledgment. Each has a different signer, timing and home.
- GoHighLevel has three tools for them: Forms and Surveys (checkboxes, Terms & Conditions element, signature and file upload fields), Documents & Contracts (templates, signing, certificate with IP and timestamp) and workflows that send a template when something happens. It has no ready-made med spa consent library.
- HighLevel's HIPAA article lists form and survey submissions among the data the HIPAA add-on protects, but does not say whether signed documents beyond the BAA are covered. Ask HighLevel support before storing signed clinical consents there.
- A HIPAA authorization has core elements set by 45 CFR 164.508(c): a description of the information, who discloses, who receives, each purpose, an expiration, and a signature and date. A general photo release often lacks several of them.
- This page is a checklist of what typically appears, not legal forms. State rules vary; have counsel review every form before use.
The problem this page solves: a med spa owner knows clients must sign things before treatment, but not which med spa consent forms are separate, who signs each, when, and which of them should sit in GoHighLevel versus the charting system. This is general information and a checklist of what such forms typically contain. It is not legal advice and not a form to copy. Have a healthcare attorney in your state review every form before clients sign it.
This page sits under our GoHighLevel setup for med spas guide. For the HIPAA coverage question, see GoHighLevel for med spas, and for the e-signature feature itself, does GoHighLevel have e-signatures.
Which med spa consent forms do you need, and who signs each?
Most med spas keep five consent documents separate: treatment consent, photo and media consent, a financial and cancellation policy, texting consent and a privacy notice acknowledgment. The table shows each one’s purpose, signer, timing and where it can live in GoHighLevel.
| Consent type | Purpose | Who signs | When | Where it lives in GoHighLevel |
|---|---|---|---|---|
| Treatment consent (per procedure type) | Records that the client was told about the procedure, risks, alternatives and aftercare and agreed to proceed | Client, and usually the provider; a guardian if the client is a minor, where state law allows treatment at all | Before the first treatment of each type, and again when the procedure or product changes | Often the charting or booking platform, because it belongs in the clinical record. GoHighLevel can send a Documents & Contracts template ahead of the visit if counsel agrees |
| Photo and media consent | Permission to take photos for the record, for training, and, separately, for marketing | Client | Before photos are taken, and before any image is published | A separate Documents & Contracts template or form with a signature field; store the yes or no as a contact custom field |
| Financial and cancellation policy | Deposits, no-show and late-cancel fees, refunds, package and membership terms | Client | At booking or at the first paid consultation | Documents & Contracts template or a form with a required Terms & Conditions checkbox, sent by workflow at booking |
| Texting consent | Permission to receive appointment texts and, separately, promotional texts | Client, by checkbox | On every form that collects a phone number | Form checkboxes plus custom fields; see our TCPA setup guide |
| Privacy notice acknowledgment | Confirms the client received the practice’s privacy notice | Client | First visit or first form | A form checkbox or a one-field Document, with the notice linked or attached |
Two rules sit behind the table. First, keep the permissions separate. A client who declines marketing photos must still be able to get treated, and a client who accepts appointment texts has not agreed to offers. Second, decide the system of record before you build. Our med spa setup page recommends the booking or charting platform own appointments, treatments and charts, and GoHighLevel own lead source, pipeline stage and marketing consent. Clinical consents follow the chart.
What does GoHighLevel give you for consent forms?
GoHighLevel gives you three building blocks: Forms and Surveys, Documents & Contracts, and workflows that connect them. It does not give you legal wording, and it does not include a clinical chart.
| Tool | What it does for consent | What we verified (HighLevel pages, 2026-10-15) | Limit to plan around |
|---|---|---|---|
| Forms and Surveys | Collect checkboxes, a Terms & Conditions element, signature and file upload fields | HighLevel’s conditional logic article lists Terms & Conditions (TnC1 and TnC2), File Upload and Signature as form fields. A changelog says the Terms & Conditions element is added automatically with a phone field in the new Form Builder and shows in submissions | A drawn signature in a form is not the same as a signed document with a certificate |
| Documents & Contracts | Send a template for e-signature; signed copy and certificate with IP address, email and timestamp; up to six signer roles | HighLevel’s article describes Send via Email or Share via Link, and a Completed tab for signed documents | The article does not mention SMS delivery, and says nothing about HIPAA |
| Workflow action: Send Documents & Contracts | Sends a saved template when a trigger fires, as a draft for staff review or sent directly | HighLevel’s article lists channel options as Email or Direct and says status is checked only when the contact enters the workflow | Build a second workflow on the Document Signed trigger to react to signing |
| File Upload custom field | Holds a PDF or image on the contact record | Up to 250 MB per file; PDF, DOCX, PNG, JPG, CSV, PPTX, XLSX; videos not supported | Not a clinical photo library; see the HIPAA section below |
| Contact document area | Lists sent and completed documents for the contact; download the PDF | HighLevel’s contact documents article lists download, view source and copy link actions | The article is undated; confirm the layout in your account |
The step-by-step build is in how to send and store med spa consent forms in GoHighLevel. The photo form has its own requirements, covered in med spa photo consent form requirements.
Should treatment consent forms live in GoHighLevel or the charting system?
For most med spas the charting or booking platform should hold treatment consents, and GoHighLevel should hold the marketing and policy documents. A treatment consent is part of the clinical record, tied to a procedure, a provider, a product lot and a chart note. GoHighLevel has no chart for it to attach to.
That is a recommendation based on how the systems are built, not a rule. Boulevard, Mangomint, Pabau and similar platforms list forms and consent workflows as part of their product, and our med spa comparison shows which platforms charge extra for forms. If you run GoHighLevel alongside one of them, the clean split looks like this.
| Document | Primary home | GoHighLevel’s role |
|---|---|---|
| Treatment consent | Charting or booking platform | None, or a pre-visit reminder to complete it |
| Medical history and intake | Charting or booking platform | None; keep clinical answers out of the CRM |
| Photo release for marketing | GoHighLevel or charting platform, one owner | Hold the signed PDF and a yes or no custom field that blocks marketing use |
| Financial and cancellation policy | GoHighLevel at booking | Send, collect and file |
| Texting consent | GoHighLevel forms | Capture, timestamp and gate workflows |
| Privacy notice acknowledgment | Wherever the first form is | Capture if the first form is a GoHighLevel form |
If you must collect treatment consents in GoHighLevel, for example because you have no booking platform, keep two points in mind. A treatment consent is a clinical document, and some states regulate medical consent content and who may obtain it. We did not open a state source for this page, so we cannot tell you your state’s rules: they vary, and counsel must confirm them.
Does GoHighLevel’s HIPAA add-on cover consent forms?
HighLevel’s HIPAA article lists form and survey submissions among the data the add-on covers, and says HIPAA documents are generated and stored in Documents & Contracts. It does not say whether general signed documents and file uploads outside email are covered. We opened HighLevel’s HIPAA article on 2026-10-15 and found no statement on that point.
What that means in practice:
- If your med spa is a HIPAA covered entity, treat any consent that contains health information as protected data, and do not store it in a sub-account where HIPAA is not switched on. HighLevel says HIPAA must be enabled for each sub-account.
- Ask HighLevel support, in writing, whether signed documents and File Upload custom fields are covered before you rely on them for signed clinical consents.
- A purely cash-pay med spa may or may not be a covered entity under 45 CFR 160.103; state privacy and medical board rules can apply either way. Our is GoHighLevel HIPAA compliant answer and HIPAA setup steps cover the add-on’s cost and activation.
- The add-on does not write your policies or make your forms valid. HighLevel’s article says the agency must also meet its own HIPAA obligations.
What typically appears in each consent form?
These are checklists of items commonly seen, so you can compare them with what your attorney drafts. They are not complete and they are not wording to paste.
Treatment consent, typical items
- Name of the procedure and product category, in plain language
- Purpose, expected course, and realistic limits (no promised results)
- Known risks and side effects, and alternatives including no treatment
- Pre- and post-treatment instructions, and who to contact with problems
- Health history disclosure and the client’s statement that answers are accurate
- Who performs the treatment and who supervises, as your state requires
- Signature, printed name, date, and a provider signature where used
Photo and media consent, typical items
- Separate choices: chart record only, internal training, external marketing
- Which channels (website, social, ads), and whether the face or other identifying features may show
- Duration or expiration, and how to withdraw in writing
- Statement that treatment does not depend on agreeing to marketing use
- Signature and date
The photo form carries stricter structure. See the photo consent requirements guide.
Financial and cancellation policy, typical items
- Deposit amount, what it applies to, and when it is refundable
- Late-cancel and no-show fees and the notice window
- Package and membership terms: expiry, transfer, pause, cancel, refund
- Payment method authorization if a card is kept on file, with the amount and trigger stated
- Signature or a required acceptance checkbox
Texting consent, typical items
- Two separate unchecked checkboxes: appointment reminders and offers
- Plain statement of message types and frequency, “Msg and data rates may apply,” and how to stop
- Links to the privacy policy and terms
- Records of the exact wording shown, the time and the form
The wording, proof to keep and STOP handling are in our GoHighLevel TCPA guide. Carrier registration for the same texts is covered in GoHighLevel A2P registration for med spas, and testimonial and advertising rules in med spa text and ad compliance in GoHighLevel.
Privacy notice acknowledgment, typical items
- The notice itself, linked or attached
- A statement that the client received it, with a date
- A contact for privacy questions
How do you send consent forms before the appointment?
Send them from a workflow that fires at booking. The trigger is the appointment booked, the action is Send Documents & Contracts (or a form link in a message), and a second workflow on Document Signed marks the consent as done and stops reminders about it.
Design points worth settling before you build:
- Reminder text content. If you text a link to a consent form, keep the message generic. “Please complete your forms before your visit” carries no treatment name. See med spa text message templates without PHI.
- Channel. HighLevel’s workflow article lists Email or Direct. If you want a form link by text, a Forms link in a message is the simpler route.
- Draft review. The action can create a draft for a staff member to check before sending, which suits documents that pull in custom values such as a price.
- One consent, one record. Do not bundle the photo release into the treatment consent. Send it as its own item.
The full click path, including where the signed copy lands, is in the send and store guide.
What mistakes make a med spa consent setup fail?
| Mistake | Why it hurts | Fix |
|---|---|---|
| One checkbox for texts, photos and policy | Cannot show separate agreement for each purpose | One field per permission, each saved to its own custom field |
| Pre-checked consent boxes | The client did not take an action to agree | Leave consent boxes unchecked |
| Photo release folded into the treatment consent | A HIPAA authorization generally cannot be combined with other documents, and marketing use needs its own authorization | Separate document with its own signature |
| Signed forms only in an email thread | Cannot be found or produced later | Store the PDF on the contact or in the chart, with a custom field recording the date |
| Deleting forms when a tool is cancelled | Records may need to be kept for years | Export before cancelling; ask counsel for the retention period |
| Marketing workflows that ignore the consent field | Sends promotions or publishes photos without permission | Add a condition on the consent field to every marketing workflow |
| Copying a competitor’s form | Wording may not fit your state or procedures | Have counsel draft or review |
Who builds this?
aibrevo scopes GoHighLevel builds for med spas, including consent capture, document templates and the workflows that send and gate them, as part of its GoHighLevel implementation service. aibrevo works with its partner company autoesta, whose team delivers GoHighLevel builds. We build the plumbing; your attorney owns the wording. To scope it, send us a message.
Founder’s note, Alpit Patel. I see med spas keep consents in three places and then struggle to find one. Pick the system of record before you build any form. Clinical consents follow the chart. GoHighLevel holds the marketing and policy documents and the yes or no fields that gate workflows. Keep each permission as its own document and field, because a photo release folded into a treatment consent cannot show separate agreement. Before relying on signed documents or file uploads for clinical consents, ask HighLevel support in writing whether the HIPAA add-on covers them. I founded aibrevo in San Francisco in 2021, and through autoesta I have overseen 320+ GoHighLevel implementation projects across med spas, real estate, healthcare, dental, home services, SaaS and professional-services clients in the US, UK and UAE. About Alpit
Sources
All checked 2026-10-15.
- HighLevel Support, How to use Documents & Contracts: templates, Send via Email or Share via Link, Completed tab, signature certificate with IP, email and timestamp, mentions SSL encryption, no mention of HIPAA.
- HighLevel Support, Workflow Action: Send Documents & Contracts: setup steps, Email or Direct channel, Create as Draft versus Send Directly, status checked only on workflow entry. No modified date shown.
- HighLevel Support, HIPAA Compliance with HighLevel: form and survey submissions listed as covered; HIPAA documents stored in Documents & Contracts; per-sub-account activation; agency’s own obligations. No modified date shown on the page we opened.
- HighLevel Support, Conditional Logic in Forms: Terms & Conditions, File Upload and Signature listed as form fields.
- HighLevel changelog, New Terms and Conditions element added to Form Builder: consent element for phone collection, visible in submissions. No explicit date on the page.
- HighLevel Support, Adding files to contacts using a custom field: 250 MB per file, formats, storage on the contact.
- HighLevel Support, Easy management of documents and contracts within contacts: documents listed per contact, download PDF, view source, copy link.
- eCFR, 45 CFR 164.508: authorization elements, compound authorization limits, marketing authorization.
- eCFR, 45 CFR 164.530: six-year documentation retention, (j)(2).
- eCFR, 45 CFR 160.103: covered entity definition, as cited on our existing HIPAA pages.
- Our own pages for the e-signature feature, setup scope and TCPA consent, linked above.
All pages in this guide
- Med Spa Photo Consent Form Requirements: What the Form Typically Needs Blog
A med spa photo consent form is not just a photo release. If HIPAA applies, using a client's photos in marketing generally needs a written authorization with specific elements: what is used, who shares it, who receives it, the purpose, an expiration, a revocation notice and a signature. Even where HIPAA does not apply, state law and FTC rules still reach before-and-after marketing. - How to Send Med Spa Consent Forms in GoHighLevel and Store the Signed Copy Blog
To send med spa consent forms in GoHighLevel, build each consent as a Documents & Contracts template, send it from a workflow when the appointment is booked, and let the signed copy land in the Completed tab and the contact's document area. Record each permission in its own custom field so marketing workflows can check it. Keep clinical consents in your charting system unless counsel and HighLevel support confirm otherwise.