AI voice agents for med spas and aesthetics answer and place front-desk calls such as bookings, reschedules, price questions and reminders. They read every slot and price from the spa's own systems. They never give treatment advice, and every clinical question goes to a licensed clinician. A call that promotes a treatment generally needs the client's prior express written consent.
Key Takeaways
- The agent books and answers. Clinical questions go to a licensed clinician.
- HIPAA may apply to a med spa, depending on how it bills.
- A "you're due" call that promotes a treatment needs written consent first.
This guide covers each med spa front-desk call and where clinical and legal limits fall. We show how each runs in Dograh, the open-source AI voice agent platform we build, reading and writing your booking system during the call. You can self-host it or run it on Dograh Cloud.
What a med spa phone line hears
Most calls to a med spa are front-desk work. A new client asks about a consultation, a regular moves a booking, someone asks what a package costs, and now and then a client calls after a treatment.
Existing clients carry the calendar. In Zenoti's 2026 benchmark report, new client visits to med spas fell 11% in 2025, existing client visits fell 2%, and membership sales rose 13%. Top-performing spas had providers booked for 80% of their available time, while the median spa managed 38%. A missed call from a regular is a gap in a provider's day that may never fill.
The agent can take most of these calls from start to finish. The exception, a call about how a treatment went, belongs to a clinician, and a later section covers it. Every answer the agent gives comes from your booking system or your own documents, never from the model's general knowledge.
Your price list, package terms, cancellation policy and first-visit notes go into Dograh's Knowledge Base as PDF, DOCX or text files of up to 5 MB each. Keep clinical documents such as aftercare sheets out of it, so the agent has nothing clinical to quote. For the general inbound setup, from greeting to handover, see The Ultimate Guide to AI Receptionists.
Booking and rebooking from live slots
The agent books only slots your booking system returns during the call, and writes each booking back before it confirms it to the client.
Dograh has no built-in connector for med spa booking software. An HTTP API tool calls your booking system's own API during the conversation. One request reads open slots for the treatment and provider, and a second writes the booking. Zenoti, for example, publishes API calls to retrieve available slots, create a booking, reserve a slot and confirm it. Check that your own system offers an API before you plan the call.
A phone number finds a client record, but it does not prove who is calling. Before the agent names past treatments or an existing booking, it asks for an approved check, such as the client's date of birth. Treatment history is health information, so the order matters.
Rebooking is two separate calls. A reminder for a visit already in the diary keeps it from slipping. Zenoti's report found that 37% of appointments rebooked after a client's first visit were later cancelled. A call to a client who is due for a treatment but has no booking is a different call with different rules, covered below. AI voice agents for med spa booking and rebooking walks through both calls, including how to stop a retried request from booking a slot twice.
The agent never gives treatment advice
The agent runs the front desk, never the treatment room. It does not judge who suits a treatment or how much product to use. Whether a client is due back is a clinician's call too.
Injectables and laser treatments are medical procedures, and the person who assesses a client and recommends a treatment should be a licensed provider. We treat the agent like an unlicensed member of the front-desk team. It can say what the spa offers and what it costs, then book a provider's free time. Questions such as "Can I have filler while breastfeeding?", "How many units will I need?", "Is it safe to come back early?" or "Should I stop my retinol first?" go to a clinician, by transfer or as a callback request.
Write that rule once in the Global Node. Its Global Prompt is added to every step that has "Add Global Prompt" turned on, so each step carries the same instruction to never recommend a treatment or judge suitability, and to offer a clinician instead.
A prompt guides the model, but it cannot guarantee the words. The model can avoid a banned phrase and still say its meaning, such as "most people your age do fine with that". Exact wording holds only where Dograh plays fixed text or a recording, which means the Greeting Text, a pathway's Transition Speech or a pre-recorded clip. So read transcripts for any line that sounds like advice. Dograh's QA scores each step of a call against your rules, on test calls and on a sample of live ones.
Open Source Alternative to Vapi / Retell
Self-hosted voice agent platform — no per-minute fees
dograh-hq/dograh
Star on GitHub
Calls about a reaction after treatment
A client calling about a reaction hears the spa's fixed urgent-care line and goes straight to a clinician. The agent never judges the symptom.
The stakes are real. The FDA's guidance on dermal fillers names injection into a blood vessel as the most concerning risk, with complications that include tissue death, vision problems including blindness, and stroke. It tells patients to seek immediate medical attention for unusual pain, vision changes, skin near the injection site turning white, grey or blue, or any sign of a stroke during or shortly after the procedure.
In Dograh, set a pathway whose condition describes a client reporting any symptom or reaction after a treatment. Its Transition Speech plays the spa's own words, approved by the medical director, for example: "If you have vision changes, severe pain, skin turning white or blue near the treated area, or signs of a stroke, hang up and call 911 now. Otherwise, I'm connecting you to our clinician on duty." On a speech-to-speech model, text Transition Speech does not play, so record the line instead.
Choosing that pathway is the model reading its condition, so it is never a hard rule. Write the condition broadly, so "my lip looks a bit pale" counts, and test it with the phrases your clinicians actually hear.
The next step is Transfer Call to the clinician's phone. It works on Twilio, Telnyx, Plivo, Cloudonix and Asterisk ARI. Dograh calls the destination first and connects the client only when someone answers. On Twilio, it can play a short spoken introduction to both people before connecting them. No summary goes across by default, so the agent first writes the client's name and what they reported to your system. If nobody answers within the 30-second default, the client stays with the agent, so the prompt tells it to repeat the urgent advice and write an urgent callback request.
HIPAA may apply, depending on how you bill
A med spa that gives medical treatments may be covered by the Health Insurance Portability and Accountability Act (HIPAA). What decides it is how the spa bills.
Under HIPAA's definitions, a health care provider is anyone who furnishes care related to a person's health, or bills or is paid for it, which takes in injectables and laser work. A provider becomes a covered entity, bound by HIPAA's privacy and security rules, only when it sends health information electronically in one of HIPAA's standard transactions, such as an insurance claim or an eligibility check.
Many med spas are cash-pay and never send those transactions, so they may sit outside HIPAA. Others bill insurance for some medical services and are covered. A spa that mixes medical and purely cosmetic services can sometimes ring-fence its medical side as a hybrid entity. Which one you are decides which contracts your voice stack needs, covered in the data section below.
Outside HIPAA, health data still has rules. Washington's My Health My Data Act protects consumer health data that HIPAA does not cover, and it reaches businesses that serve Washington consumers. A client's treatment history, spoken on a call, can be that kind of data.
Rebooking calls that promote a treatment need consent
A call you place to encourage a client to book a treatment is a sales call, and it generally needs the client's prior express written consent first.
The Telephone Consumer Protection Act (TCPA) is applied through the FCC's calling rule. The rule treats a call made to encourage buying a service as telemarketing. It allows a telemarketing call with an artificial or prerecorded voice to a mobile or home line only with the person's prior express written consent, meaning a signed agreement that clearly authorizes the business to make such calls to that number. In February 2024, the FCC ruled that AI-generated voices count as artificial voices.
Read together, a "you're due for your next treatment" call from an AI agent is generally a sales call. The rule does exempt health care messages sent by HIPAA covered entities, but whether a call promoting an elective cosmetic treatment counts is unsettled, and many spas are not covered entities at all. Written consent holds up either way.
A reminder for a visit the client already booked is different. It promotes nothing and generally rests on the number the client gave when booking. Keep offers off that call, or it becomes a sales call too. AI voice agents for upsell and cross-sell explains that line for any business.
Dograh stores no consent record, so the check happens before upload. Build the rebooking list in your own system from clients with signed consent on file, then upload it to Campaigns. The sales call must also name the spa at the start and let the client opt out by voice straight after, so put both in the Greeting Text. A client can withdraw consent in any reasonable way, and the rule gives you ten business days to honour it. When a client says stop, the agent writes it to your system. The do_not_call call tag marks the call but never blocks a later one, so remove those numbers before the next upload, and have counsel confirm your HIPAA and calling-rule position.
Deposits and payments stay off the call
Dograh has no feature for taking payments on a call and no keypad (DTMF) tool, so nobody reads out a card number.
When a booking needs a deposit, the agent asks your booking system or payment provider to send its secure deposit link by text or email. Dograh sends no texts itself. The agent can read your deposit and cancellation policy from the Knowledge Base, but a request to waive a fee goes to a person.
Join the Dograh Community
Dograh is an OSS alternative to Vapi. Join our Slack community for queries, releases, best practices & community interactions.
Where the client's call data goes
Count every company that hears the call. On a hosted AI receptionist, that can be the voice platform, each model provider and the phone carrier.
Self-hosting Dograh keeps the call flow, recordings and transcripts on your servers. Dograh is the orchestration layer that runs the call flow, tools and telephony, and the speech and language models are a separate layer you choose. Model providers you use with your own API keys still receive the audio. Only open-weight models running on your own servers keep it in-house.
If HIPAA applies, self-hosting means no business associate agreement (BAA) with Dograh is needed. Model providers that handle protected health information need their own. The phone carrier may need one, depending on what it stores. Many, such as Twilio, offer one. If your servers run in a cloud account such as AWS, Google Cloud or Azure, that cloud provider needs a BAA too. HIPAA-compliant voice AI for hospitals counts each vendor in the call path.
Self-hosted, recording can be switched off only server-wide, not per agent, and transcripts are still saved. There is no retention setting, so your own deletion policy covers both. Self-hosted Dograh has no per-minute platform fee (servers, model keys and phone minutes still cost). Dograh Cloud has a 1¢-a-minute platform fee.
Which call to hand over first
Start with the inbound calls your front desk misses, such as after-hours booking requests and price questions. They promote nothing, and every answer comes from your booking system or documents.
Next, add reminder calls for visits already booked. Leave the consented rebooking campaign for last, once transcripts show the agent keeps clinical questions with clinicians.
Test over a real phone call as well as in the browser. Most phone calls still reach the agent as 8 kHz audio, while a browser demo runs at 16 kHz, so treatment names are harder to hear. Add names such as Botox and Juvederm to the Dictionary in the agent's Settings. Then run QA on a random 5 to 10% sample of live calls.
If you want to tell callers they're speaking with an automated assistant, or your location requires it by law, write it in the Greeting Text along with the spa's name.
The booking and rebooking calls above have their own deep dive:
Glossary
- Covered entity
- Under HIPAA, a health plan, a clearinghouse, or a health care provider that sends health information electronically in a standard transaction such as an insurance claim. A cash-pay med spa that never sends one may not be covered.
- Prior express written consent
- A signed agreement that clearly authorizes a business to make sales calls with an artificial or prerecorded voice, including an AI voice, to a named phone number. A promotional rebooking call generally needs it before the first dial.
- Telemarketing
- In the FCC's calling rule, a call made to encourage someone to buy or rent goods or services. A call suggesting a client book their next treatment generally counts. A reminder for a visit already booked does not.
- Transition Speech
- Fixed text or a recorded clip that Dograh plays word for word when the call moves along a pathway. It is where a med spa's approved urgent-care line belongs, since a prompt cannot guarantee exact wording.
