GoHighLevel · Solution guide
GoHighLevel for Med Spas: HIPAA, Pricing and Setup vs Boulevard and Mangomint
Quick answer
GoHighLevel is a good fit for the marketing and follow-up side of a med spa, and a poor fit as the clinical or booking system of record. It captures leads, answers missed calls by text, sends reminders, runs reactivation campaigns and requests reviews.
Key takeaways
- GoHighLevel lists at $97, $297 and $497 a month, and its HIPAA add-on is a separate $297 a month that cannot be turned off once enabled (HighLevel pricing page and HIPAA support article, June 2026). A HIPAA-ready med spa account therefore starts at $394 a month before SMS, voice or email usage.
- Boulevard and Mangomint bundle booking, charting and payments in one subscription: Mangomint is $120 a month plus $10 per extra user and Boulevard runs $143 to $328 a month per location on the vendor pricing pages checked 20 September 2026. GoHighLevel has no clinical charting, so it sits next to that software rather than replacing it.
- The add-on gives you encryption, a signed Business Associate Agreement, audit logging and enforced MFA. It does not make a practice compliant, and HighLevel's own documentation says the practice still owns its policies, training and risk assessment.
- AmSpa's 2024 report puts average annual med spa revenue at $1,398,833 and the repeat-patient rate at 73%. At roughly $527 per visit, the add-on plus platform cost is covered by about one to two recovered visits a month, which is why the question is fit, not price.
- Whether a med spa is even a HIPAA covered entity depends on whether it transmits health information electronically in standard transactions such as insurance claims. Many cash-pay practices are not, which changes how much of the HIPAA setup they need. That is a question for a healthcare attorney.
Is GoHighLevel a good CRM for a med spa?
GoHighLevel is a good fit for the marketing and follow-up side of a med spa, and a poor fit as the clinical or booking system of record. It captures leads, answers missed calls by text, sends reminders, runs reactivation campaigns and requests reviews. It has no treatment charting, no consent-form library built for aesthetics, no inventory tracking and no integrated point of sale designed for injectables, lasers or memberships.
That answer is narrower than most articles on this topic. Content aimed at med spa owners tends to treat the question as a choice between GoHighLevel and Boulevard or Mangomint. In practice those are two different product categories. Boulevard, Mangomint, Pabau and Aesthetic Record are practice-management platforms: they hold the schedule, the client record, the charts, the forms, the retail sales and the card processing. GoHighLevel is a CRM and marketing automation platform originally built for agencies. Its strength is the pipeline of people who have not yet booked, or who booked once and have gone quiet.
So the useful question is not which one is better. It is which problem is costing your practice money right now. If the answer is that inquiries from Instagram, Google and Meta ads sit unanswered for hours, or that clients who had a neurotoxin treatment 14 weeks ago never hear from you again, that is a follow-up problem, and GoHighLevel is a reasonable tool for it. If the answer is that charts are on paper, consent forms are scattered and the front desk double-books, that is a practice-management problem, and no CRM will fix it.
A practical test is to list your last ten lost opportunities. If most were people who inquired and never booked, or clients who lapsed, you have a CRM problem. If most were scheduling errors, missing consent forms or billing mistakes, you have a practice-management problem. Med spas commonly have both, which is why the sections below cover how the two systems fit together and where the money goes.
One more scope note. This article is deliberately about platform fit, price and HIPAA setup. The companion guide on GoHighLevel automation workflows for med spas covers the individual sequences (speed to lead, no-show recovery, membership renewal, review requests) in detail, so they are not repeated here.
The short verdict by practice type
| Practice situation | Likely best approach |
|---|---|
| One injector, a few hundred clients, no ad spend | Med spa booking platform alone; use its built-in texting and marketing add-on |
| Steady paid-ad lead flow, inquiries handled by a busy front desk | Booking platform plus GoHighLevel for lead capture and follow-up |
| Multi-location group wanting one lead pipeline and shared templates | GoHighLevel snapshot across locations, plus a booking platform per location |
| Practice wanting a single all-in-one system with clinical charting | An aesthetics platform with built-in marketing; GoHighLevel is not that |
| Practice that only needs review requests and appointment reminders | Whatever the booking platform already offers; GoHighLevel is overbuilt |
What does GoHighLevel do that med spa software does not, and the reverse?
GoHighLevel covers the pre-booking and post-visit communication layer in more depth than med spa software, while med spa software covers everything that happens inside the treatment room and at the register. The overlap is small: both have a calendar, both send text and email, and both take online bookings.
The split matters because it determines what you would have to rebuild if you tried to use only one. The table below compares capabilities using each vendor’s own descriptions of what the product includes. GoHighLevel’s entries reflect its pricing page and support documentation; Mangomint and Boulevard entries reflect their pricing pages checked on 20 September 2026.
| Capability | GoHighLevel | Boulevard / Mangomint / Pabau class |
|---|---|---|
| Lead capture forms, funnels, landing pages | Core feature, all plans | Basic online booking widget; funnels generally absent |
| Missed-call text-back, two-way SMS inbox | Core feature (metered usage) | Texting included in allowances (Boulevard lists 250 free texts on entry tiers) |
| Multi-step nurture and reactivation workflows | Visual workflow builder, deep branching | Automated campaigns exist; branching depth varies by vendor |
| Pipeline for unbooked leads | Native opportunities and pipelines | Usually a client list, not a lead pipeline |
| Calendar and online booking | Yes, but not built around treatment rooms, provider skill or equipment | Core feature, aesthetics-aware |
| Clinical charting, treatment notes, photos | Not a feature | Core feature (Mangomint lists charting and forms in the base plan) |
| Consent and intake forms | Generic forms and surveys | Med spa form libraries; Boulevard sells Forms as an add-on from $65 a month per location |
| Retail inventory, gift cards, packages, POS | Invoices and Stripe payments only | Core feature |
| Membership billing with usage tracking | Possible with custom fields and Stripe, but manual to build | Native in most platforms |
| HIPAA business associate agreement | Add-on at $297 a month | Varies by vendor; ask for the BAA before purchase |
Two conclusions follow from that table. First, if you dropped a booking platform for GoHighLevel to save money, you would need to replace charting, intake, inventory and POS with other tools, and the saving disappears. Second, if you dropped GoHighLevel and relied only on a booking platform’s marketing features, you would keep working clinical records but lose the funnels, the pipeline view and the flexibility to build custom follow-up logic.
Where the vendors themselves draw the line
The vendors’ own pricing pages tell the same story. Mangomint sells a marketing add-on separately from its base subscription, starting at $30 a month, and lists phone lines at $70 a month per line. Boulevard lists messages and text marketing as pay-per-use, and its automated campaigns are described as free to send. Pabau, in its own published comparison, positions itself as the option with clinical documentation, consent form workflows, treatment records and prescription management alongside booking. None of them are marketing platforms first, and none claim to be.
How much does GoHighLevel cost for a med spa compared with Boulevard, Mangomint and Pabau?
For a med spa that needs HIPAA handling, GoHighLevel costs from $394 a month (Starter plus the HIPAA add-on) before usage, compared with $120 to $328 a month for Mangomint or Boulevard, which include booking and charting. The categories differ, so the fair comparison is the combined cost of the system you would run.
The GoHighLevel figures below come from its pricing page (checked 20 September 2026): Starter $97, Unlimited $297 and Agency Pro $497 a month, with HIPAA compliance listed as a $297 a month add-on. The Mangomint and Boulevard figures come from their own pricing pages on the same date.
| Product | Entry price | Higher tiers | What is extra |
|---|---|---|---|
| GoHighLevel Starter | $97/mo | Unlimited $297/mo, Agency Pro $497/mo | HIPAA $297/mo; SMS, voice, email metered; phone numbers |
| GoHighLevel plus HIPAA | $394/mo (Starter) | $594/mo (Unlimited) | Usage; A2P registration fees |
| Mangomint | $120/mo plus $10 per additional user | One plan | Marketing from $30/mo, phone $70/mo per line, extra location $120/mo, payment processing |
| Boulevard Essentials | $143/mo (up to 5 providers) | Premier $234, Prestige $328 per location (limited-time; listed normal prices $293 and $410) | Forms from $65/mo per location, ePrescribe $45 per prescriber, pay-per-use messaging |
| Pabau | From about $59 per user per month per Pabau’s own published comparison | Tiers vary by clinic size | Confirm add-ons directly with the vendor |
| Aesthetic Record | From about $15 to $19 per user per month, plus $399 one-time onboarding (as previously published by aibrevo; verify current figures) | Lead-capture product sold separately at about $97/mo | Not re-verified 20 September 2026 |
A caution on these numbers. Third-party roundups do not agree with the vendor pages. One comparison published on Pabau’s blog describes Mangomint as three flat tiers from $165 to $375 a month and Boulevard medspa plans from $369 a month, and other roundups quote different figures again. Vendors change plans, run limited-time pricing and sell medspa-specific bundles that may not match the salon-and-spa plans shown publicly. Treat every price here as a snapshot, and get a written quote that names the exact plan, provider count, location count and the add-ons you need (forms, phone, marketing) before comparing.
What the combined stack costs
A stack that runs both a booking platform and GoHighLevel is where most owners end up, so the combined figure is the one to budget. The chart below adds up illustrative combinations using the list prices above. It is an arithmetic illustration, not a quote.
The largest single step in that chart is the HIPAA add-on, not the platform. That leads directly to the question most med spa owners actually search for.
Is GoHighLevel HIPAA compliant, and does a med spa need the add-on?
GoHighLevel is not HIPAA compliant by default. HighLevel sells a HIPAA add-on at $297 a month that enables encryption of electronic protected health information, Business Associate Agreements, audit logging and multi-factor authentication enforcement, and the vendor states that it does not by itself make your organization compliant.
Those details come from HighLevel’s own HIPAA support article, last updated 11 June 2026. The article lists the protected data types as contacts, notes, custom fields, SMS and MMS, voice recordings, email bodies and attachments, form and survey submissions, calendars and invoices. The mobile app’s conversations, calendars and contacts inherit the same protection. Encryption is described as 256-bit AES applied before storage.
Three constraints in that article decide whether the add-on suits your practice:
- It is permanent. The article says the add-on cannot be disabled once purchased and is non-cancellable and non-refundable. Third-party guides report that the only way out is closing the whole account. Test with a trial account first if you are unsure.
- It is agency-wide, but activated per location. After the BAA is signed, the owner must manually activate HIPAA for each sub-account. A location you forget to switch on is not protected.
- It is not transferable between non-compliant agencies, so you cannot start on a non-HIPAA agency account and simply move to a compliant one later.
HighLevel also offers a HIPAA compliance certification track for its Certified Admin program, which is useful evidence when vetting a builder but is training, not legal advice.
What the add-on does not do
The add-on covers the platform’s side of the arrangement. It does not write your privacy policies, train your staff, perform your risk assessment, restrict which staff can see which records, or control what leaves the system through integrations. Any third-party tool you connect through Zapier, webhooks or the API is a separate vendor that may need its own BAA if protected health information passes through it. This is the point most often missed: a HIPAA-enabled GoHighLevel account that forwards patient names and treatments into a non-compliant spreadsheet or chat tool has moved the exposure, not removed it.
Does a cash-pay med spa need HIPAA setup at all?
Possibly not in the way most guides assume. Under HHS’s definition, a health care provider is a HIPAA covered entity only if it transmits health information electronically in connection with standard transactions such as claims or eligibility checks. A practice that is purely cash-pay and never submits those transactions may not be a covered entity, though that is a legal determination, and some med spas are affiliated with medical practices or physician supervisors that do bill insurance for other services. State health privacy laws and medical board rules can also apply regardless of HIPAA.
The practical position is this. If your legal counsel confirms you are a covered entity, or if you want to be treated as one by policy, use the add-on and sign the BAA. If counsel confirms you are not, you may still choose to handle treatment-specific messaging conservatively, but you would be making a risk decision, not meeting a legal requirement. In both cases, get the opinion in writing before you spend $3,564 a year on an add-on you cannot cancel.
Which med spa messages count as protected health information?
A message counts as protected health information when it identifies a person and relates to their health condition, care or payment for care. A treatment-specific text such as a neurotoxin touch-up reminder is more likely to qualify than a generic appointment reminder or a seasonal promotion, but classification is a policy decision your counsel should confirm.
The distinction shows up in three places in a GoHighLevel build.
Reminders. “Your appointment is tomorrow at 2:00” carries little health context. “Your filler follow-up is tomorrow at 2:00” names a treatment. Many practices write reminder templates in the generic form for that reason, even when HIPAA is enabled.
Marketing. HHS’s marketing guidance says the Privacy Rule generally requires an individual’s written authorization to use protected health information for marketing, with limited exceptions. Communications that recommend alternative treatments or coordinate care for the individual are carved out of the definition of marketing, subject to conditions such as the practice not receiving payment from a third party for sending them. In plain terms, a reminder that a client is due for a treatment they already have is closer to a treatment communication, while a promotion for a new service sent to a broad list is closer to marketing. If you are a covered entity, that boundary should shape which contacts receive which campaign.
Photos and notes. Before-and-after photos and clinical notes should live in the charting system, not in CRM notes or SMS threads. If a client texts a photo of a reaction to the number connected to GoHighLevel, HIPAA mode encrypts it, but the better rule is to move that conversation to a channel your clinical team controls.
A simple classification table to adapt with counsel
| Message type | Health detail | Typical handling if HIPAA applies |
|---|---|---|
| Lead auto-reply to a form fill | None beyond service name they chose | Low risk; keep wording general |
| Appointment reminder, generic | None | Low risk |
| Appointment reminder naming treatment | Treatment named | Send through the HIPAA-enabled sub-account only |
| Post-treatment aftercare | Treatment-specific | HIPAA-enabled path; keep clinical detail in the portal |
| Rebooking prompt at the usual interval | Implies treatment history | Treatment-communication path; confirm with counsel |
| Broad promotion to whole list | None | Marketing; check consent and authorization rules |
| Review request | Implies the person was a patient | Keep neutral; avoid naming the treatment |
This table is a starting point for a conversation with counsel, not a compliance determination.
How do you set up HIPAA in GoHighLevel, step by step?
The order matters: decide coverage first, buy the add-on second, sign the BAA third, then switch on each location before importing any client data. Reversing that order means client data may sit in a non-protected account.
Based on HighLevel’s HIPAA support article, the mechanical sequence is:
- Confirm your status in writing. Ask counsel whether the practice is a covered entity and what messaging it should treat as protected. Save the answer.
- Purchase the HIPAA add-on under Settings, Compliance in the agency account. Read the acknowledgments about permanence and non-refundability.
- Sign the Business Associate Agreement through HighLevel’s documents and contracts flow inside the platform.
- Enable HIPAA on each sub-account location manually after the BAA is signed. Verify each one.
- Turn on and test MFA for every user, and remove shared logins.
- Set user roles so front-desk staff see only what they need.
- Build the messaging rules from your classification table, then run test contacts through each workflow.
- Import data last, starting with a small batch.
SMS registration is a separate track
Text messaging to US numbers requires A2P 10DLC brand and campaign registration, and it is not covered by the HIPAA add-on. HighLevel’s fee documentation (updated 24 September 2026) lists a one-time fee of $22.50 for a low-volume or sole-proprietor brand, or $64 for a high-volume brand, each including the first campaign and Fast Track processing that aims for approval within three business days, plus a campaign fee of $1.50 to $10 a month. Snapshots do not carry registrations across; each sub-account that sends SMS registers separately. Med spas hit rejections most often on the opt-in language and website mismatch. The dedicated guide on A2P 10DLC registration rejections walks through the fixes. Build registration into week one of your plan, because nothing texted goes out without it.
Metered costs on top of the subscription
HighLevel’s phone pricing guide, updated 1 September 2026 per aibrevo’s GoHighLevel pricing breakdown, lists SMS at $0.00747 per segment, outbound voice at $0.0166 per minute, email at $0.675 per 1,000 sends and a local number at $1.15 a month, with carrier fees added on SMS. For a med spa sending 3,000 text segments and 500 email sends a month, usage is on the order of $35 to $45 including carrier fees (illustrative arithmetic from those rates), so the subscription and add-on, not usage, dominate the bill.
Can GoHighLevel replace Boulevard, Mangomint or Pabau?
For most practices, no, because the booking platform holds the clinical record, the consent forms and the register, and GoHighLevel has no equivalent of those. The exception is a very small practice that keeps clinical records elsewhere and only needs simple scheduling and payments.
If you are considering consolidation, list what would need a replacement: charting and photos, intake and consent forms, inventory and retail, gift cards and packages, membership billing, provider commission reports, and card processing. Then price each replacement. In most cases the replacement stack costs more than the platform you removed and adds integration work.
How the two systems usually talk to each other
Most med spas that run both use one of three patterns, in descending order of reliability:
- Native or marketplace integration if the booking vendor offers one. Check the vendor’s integrations page rather than assuming.
- Automation connectors such as Zapier or webhooks, sending events like new client, appointment booked or appointment completed into GoHighLevel. This works but adds a per-task cost and a failure point.
- Scheduled exports. A weekly CSV of clients with last-visit date and treatment type is unglamorous but adequate for a monthly reactivation campaign.
Whichever you choose, the key design decision is which system is the source of truth for each field. A common and workable split is: booking platform owns appointment and treatment data; GoHighLevel owns lead source, pipeline stage, consent to marketing and campaign history. Two systems both writing to the same field guarantees drift within a month.
If the booking platform does not offer an API or connector on your plan, the integration cost can be higher than the software cost. Ask before buying. Sales teams will confirm a connector exists; ask to see it working in a demo account.
What do the industry numbers say about retention and revenue at a typical med spa?
The best-sourced numbers come from AmSpa, the American Med Spa Association: its 2024 State of the Industry report puts average annual med spa revenue at $1,398,833, up from $1,307,587 in 2023, and the repeat-patient rate at 73%, up from 65% in 2022. Those figures set the scale for what a follow-up system can plausibly move.
A few things are worth being careful about. The industry-wide no-show percentages that circulate in med spa marketing (17%, 20% and similar) trace back to vendor blog posts without a named methodology, so they are not used here. Retention is a stronger argument in any case, because AmSpa’s repeat rate is a disclosed survey figure. And the $527 average spend per visit appears as $536 in some summaries; the difference does not change the arithmetic below.
Working out whether the platform pays for itself
This is an illustrative break-even calculation, not a forecast. It divides the monthly cost of a HIPAA-ready GoHighLevel account by AmSpa’s reported average spend per visit.
| Monthly cost of setup | Visits per month needed to cover it at $527 per visit | Visits per year |
|---|---|---|
| GoHighLevel Starter alone, $97 | 0.2 | 2.2 |
| Starter plus HIPAA, $394 | 0.75 | 9 |
| Unlimited plus HIPAA, $594 | 1.13 | 13.5 |
| Higher stack, $828 | 1.6 | 18.9 |
At AmSpa’s average revenue of about $1.4 million a year, a practice handles on the order of 2,650 visits annually at $527 per visit. Covering the $394 setup means recovering or generating about 9 visits a year, roughly a third of one percent of volume. The arithmetic supports fit-first reasoning: if follow-up is genuinely broken, the software cost is unlikely to be the deciding factor; if follow-up is already handled well by the booking platform, no visit is being recovered and the spend is pure overlap.
Setup labor is the other cost. Whether you do it yourself or pay a builder, it is a one-time cost on top of the subscription; see the GoHighLevel implementation cost guide for how scope translates to price.
When is GoHighLevel the wrong tool for a med spa?
GoHighLevel is the wrong tool when your bottleneck is not lead follow-up, when nobody will own the system after launch, or when your booking platform already covers the messaging you need. Buying it to fix a problem it does not address is the most common way med spa owners end up with an expensive, unused account.
Specific cases where an alternative is better:
- Solo injector or a very small studio with mostly referral or walk-in clients. A booking platform with built-in texting handles reminders, and Mangomint’s marketing add-on starts at $30 a month. GoHighLevel’s extra $97 or more and its learning curve are hard to justify.
- No dedicated owner. GoHighLevel rewards someone who maintains workflows, checks failed sends and updates campaigns. Without that person, sequences drift and break silently. The workflow not triggering guide shows how common that is.
- You want one system of record. If you dislike syncing two systems, pick a platform with charting and marketing together.
- Heavy clinical workflows, such as e-prescribing, prescription tracking or complex multi-provider protocols. A clinical platform is the right home for these.
- Uncertain HIPAA status and no budget for legal advice. Enabling the permanent $297 add-on on a guess is expensive. Resolve status first.
- Very low ad spend and few inquiries. With ten inquiries a month, a manual process is often enough.
Alternatives worth naming
| Need | Option to evaluate |
|---|---|
| Booking, charting and marketing in one product | Pabau, Boulevard with its campaign tools, or similar aesthetics platforms |
| Simple texting and reviews at low cost | Mangomint marketing add-on or the booking platform’s native tools |
| Lead capture and funnels only | A lighter form and email tool, without HIPAA overhead |
| Custom pipelines and multi-channel follow-up | GoHighLevel |
| Enterprise-grade CRM with clinical integration | A dedicated healthcare CRM; considerably more expensive |
How long does a med spa GoHighLevel setup take and what goes wrong?
A focused single-location build commonly takes two to four weeks of elapsed time, and the waiting periods, not the building, drive most of it. Registrations, domain authentication, HIPAA activation and data cleanup each have lead times you cannot compress.
The table below shows a realistic sequence. Durations are practitioner estimates for a single location, not vendor-published figures, except where a source is noted.
| Phase | What happens | Typical elapsed time |
|---|---|---|
| 1. Decisions | Coverage opinion, message classification, source-of-truth map, which flows to build first | 2 to 5 days |
| 2. Account and HIPAA | Plan, add-on, BAA, per-location activation, MFA, roles | 1 to 3 days |
| 3. Messaging registration | A2P 10DLC brand and campaign, sending domain authentication (SPF, DKIM, DMARC) | 1 to 5 days; A2P approval documented at 24 to 72 hours when clean |
| 4. Data | Export, clean, map fields and tags, test import | 3 to 7 days |
| 5. Build | Lead capture, missed-call text-back, reminders, no-show recovery, reactivation, review requests | 5 to 10 days |
| 6. Test and launch | Test contacts, failure paths, staff walkthrough, monitored go-live | 3 to 5 days |
Phases overlap, which is how the total lands in two to four weeks instead of the sum of the ranges.
The failure patterns that recur
Launching everything at once. Turn on the highest-value flow first, usually missed-call and inquiry response, watch it for a week, then add the rest. A misconfigured reminder sent to the whole client list is hard to unsend.
Skipping the source-of-truth decision. If both systems can write the last-visit date, you will eventually text someone about a treatment they had last month as if they were overdue.
Ignoring consent and quiet hours. Marketing texts need documented consent, and messages need to respect sending windows. This is a legal and reputational issue.
Treating snapshots as complete. Snapshots do not carry contacts, integration credentials, A2P registration, billing, users, phone numbers or domain settings, according to community and vendor documentation, so a template copied from another practice is a starting layout, not a working account. HighLevel’s snapshots explainer on this site covers what transfers and what does not.
Building for the average client. A client on a quarterly maintenance cycle and a client who bought one facial need different cadences. Tag by treatment and last-visit date from the start.
What should a med spa check before choosing GoHighLevel?
Confirm five things in order: your HIPAA coverage status, whether your booking platform can pass data out, who will own the account, what the total monthly cost is with usage, and what you will do if you decide to leave. Skipping any one of them is where regret usually starts.
A short decision checklist:
| Question | If the answer is yes | If no |
|---|---|---|
| Have we lost leads because of slow or missed follow-up? | GoHighLevel addresses this directly | Fix the actual bottleneck first |
| Has counsel confirmed our HIPAA status in writing? | Proceed; buy the add-on if covered | Do this before purchasing |
| Can our booking platform send or export client and visit data? | Plan the sync | Ask the vendor; consider platforms with built-in marketing |
| Does someone own workflows weekly? | Reasonable to proceed | Do not buy yet |
| Is total cost, including add-on and usage, acceptable for 12 months? | Proceed | Consider lighter tools |
| Do we have an exit plan (export contacts, campaign history)? | Good | Write one; the HIPAA add-on cannot be cancelled separately |
For a fuller view of the automation sequences once you decide, the med spa automation guide covers each workflow. HighLevel Automation Team also publishes a practitioner guide to GoHighLevel for med spas from the healthcare-focused side of the same ecosystem.
If you would rather have the account built than build it yourself, the GoHighLevel setup for med spas page lays out what a done-for-you build includes, how it differs from installing a med spa snapshot, the week-by-week timeline and what it costs.
Sources
- HighLevel pricing page, checked 20 September 2026: plan prices, HIPAA add-on, trial terms.
- HighLevel Support: HIPAA Compliance with HighLevel, updated 11 June 2026: add-on scope, permanence, BAA process, protected data types.
- HighLevel Support: A2P 10DLC registration and fees, retrieved 20 September 2026: approval timing and fees.
- Mangomint pricing, checked 20 September 2026.
- Boulevard pricing, checked 20 September 2026 (Premier and Prestige shown at limited-time pricing).
- Pabau: Boulevard vs Mangomint and Pabau: Mangomint pricing 2026, 2026: third-party comparison figures and Pabau per-user pricing (vendor-authored).
- AmSpa: Medical Spa State of the Industry and its 2024 report recap, November 2024: revenue, repeat-patient rate, spend per visit, industry size.
- HHS: HIPAA Privacy Rule and Marketing: authorization and treatment-communication exceptions.
- HHS/CMS: Are You a Covered Entity?: covered-entity definition tied to standard transactions.
- Aesthetic Record pricing figures are carried over from aibrevo’s earlier published research and were not re-verified on 20 September 2026.