How to get more Google reviews for your med spa

To get more Google reviews for your med spa, ask every client, the same day as their visit, with a direct link that opens Google's review form in one tap. Automate the ask so it doesn't depend on a busy front desk, back it up with a QR code at checkout, and never filter who gets asked. The businesses with steady reviews aren't luckier. They just ask everyone, every time.

This guide walks through the setup we built for Elume Medspa in Fairfax, Virginia: where to find your review link, why we send the ask at about 7 PM the evening of the visit, the policy lines you can't cross (Google's and the FTC's), and how to reply to reviews without confirming that the reviewer is a patient. One honest note up front: the automation has been live since September 18, 2026, and we haven't yet measured how many new reviews it produced, so you won't see a results number here.

Why med spas struggle to get Google reviews

Med spa clients are happy to recommend you to a friend in private and slow to post publicly about a cosmetic treatment. Add a busy front desk that forgets to ask, and reviews come in a trickle. When we started working with Elume in August 2026, its Google profile rated about 4.5 to 4.6 stars from about 45 reviews, and the newest review was about three months old. The rating was fine. The silence was the problem: someone comparing med spas sees a quiet profile next to a busy one.

The fix isn't a clever tactic. It's a system that asks every client, at the right moment, with the least possible friction.

Step 1: get your direct Google review link

Don't send people to your Maps listing and hope they find the review button. Google gives you a link that opens the review form directly. According to Google's help page on creating a link or QR code to request reviews:

1. Go to your Business Profile (search your business name on Google while signed in as an owner or manager).
2. Select Read reviews, then Get more reviews.
3. Select Copy to copy the review link, or right-click the QR code and choose Save image as to download it.

Save the link somewhere the whole team can find it. It goes in your post-visit email, your text templates (for clients who opted in to texts), your email signature and the QR card at checkout.

Step 2: ask on the day of the visit

Timing matters more than wording. The best moment to ask is when the visit is fresh and the client is home with a few minutes free. For Elume, that's about 7 PM Eastern on the evening of the visit. The client is, as our notes put it, fresh out of the treatment room, but no longer in the car or back at work.

We didn't start there. The first version of the flow sent about 40 hours after the visit, and we moved it earlier. A day and a half later, the visit is old news and the email competes with everything else in the inbox.

Step 3: automate the ask

A front desk that asks every client in person is ideal. In practice, people forget on busy days. Automation makes sure the ask happens even when nobody remembers.

Some design choices worth copying:

• Trigger on the visit date, not a purchase or the moment someone books. Bookings get canceled and rescheduled. If your booking tool feeds your email platform, use the appointment date.
• One button, one job. Don't mix the review ask with offers, a newsletter or links to Yelp and Facebook as well.
• Exclude visits that aren't real treatments, such as phone consultations.
• Keep the link clean. We send the plain Google review link, with no tracking parameters added.

Why email, not your booking tool or SMS

We chose email over Calendly's built-in workflows and SMS. Calendly workflows had no consent record, would fire for no-shows, and gave no reporting. SMS wasn't an option yet because Elume's text number wasn't registered at the time. Klaviyo also doesn't treat a review ask as a transactional message, so the flow sends only to clients who subscribed to email. The front desk asks everyone else in person. That keeps volume low by design, and it keeps the program on the right side of consent rules.

Traps we hit

• Go-live day. A flow triggered by a date skips everyone whose date is today if you switch it on that day. Elume's flow went live the morning of a six-person clinic day and sent nothing to any of them. We caught it and sent those clients a one-off email instead. Switch a date-triggered flow on at least two days before the first visit that matters.
• "It's not firing" usually turned out to be the consent filter doing its job, not a broken flow. Check who was eligible before you rebuild anything.
• A task that "succeeded" can do nothing. One fix reported success after 3 seconds and wrote no data, so one client missed her review email. Verify the effect, such as a profile actually entering the flow, not the status message.

Don't gate reviews: what Google and the FTC allow

Review gating means asking clients how they feel first, then sending only the happy ones to Google and routing everyone else to a private form. Don't.

• Google: Its prohibited and restricted content policy says merchants may not "selectively solicit positive reviews from customers," discourage or prohibit negative reviews, or offer incentives such as payment, discounts or free services for any review.
• FTC: The FTC's guide on soliciting and paying for online reviews tells businesses not to ask for reviews only from customers they think will leave positive ones. The FTC's Consumer Reviews and Testimonials Rule, in effect since October 21, 2024, bans fake reviews, buying reviews conditioned on a positive or negative sentiment, and suppressing reviews with legal threats, intimidation or false accusations. Its Q&A notes the rule doesn't specifically ban asking only happy customers, but that the practice could still violate the FTC Act.

So what about Elume's "reply or call if anything went wrong" line? That's not gating, because every client gets the same email and the same Google button. The private path is an extra option, not a filter. The test is simple: does anyone, based on what they told you, lose the chance to post on Google? If yes, it's gating.

Staff habits that get reviews (and the ones Google bans)

The in-person ask still matters, especially for clients who aren't on your email list. Habits that work:

• Ask at checkout, once, casually. "If you have a minute tonight, a Google review really helps us. The link is on this card." Then stop.
• Hand over or point to the QR card. Put it at checkout, not in the treatment room.
• Tell the client what to expect. If they know an email is coming, they're more likely to open it.

Google's policy also bars three habits that some practices fall into:

• Requiring or pressuring clients to leave a review while they're still on the premises. A QR card is fine. Standing over someone while they type is not.
• Giving staff a quota for the number of reviews they collect.
• Asking clients to include specific content, including a provider's name. Injector shout-outs feel great, but you can't request them.

Also, don't have employees, friends or family review the business. The FTC's guide says insiders who review must disclose the connection, and Google treats conflicts of interest as prohibited content.

QR codes: where they help

A QR code is the in-person version of the direct link. Download it from your Business Profile (Step 1) and put it on:

• A small counter card at checkout.
• Printed aftercare instructions, near the bottom.
• Receipts, if your point-of-sale system lets you add an image.

Keep the card plain: "Tell us how we did on Google," the QR code, and nothing about rewards. Test the printed code with two different phones before you order a stack. A QR counter card is part of the review playbook we wrote for Elume.

How to respond to reviews without breaking HIPAA

Replying to reviews shows future clients that someone is paying attention. For a med spa, the reply itself is a privacy risk. HHS's Office for Civil Rights has settled several cases with healthcare providers who disclosed patient information in review responses, including a 2023 settlement with a New Jersey provider that paid $30,000 after replying to negative reviews with details of patients' diagnosis and treatment. OCR's director said plainly that this is not allowed.

Whether HIPAA technically applies to your med spa depends on whether your practice is a covered entity, which generally turns on things like electronic insurance billing. Many cash-pay med spas may not be. Reply as if it applies anyway. Clients expect it, state privacy laws may apply, and a reply that confirms someone had a treatment can't be taken back.

Rules for every reply:

• Don't confirm the person is a client. No "we're glad your filler turned out well" or "we reviewed your chart."
• Don't name or describe any treatment, date, result or provider tied to the reviewer, even if they mentioned it first. Their disclosure isn't your permission.
• Take problems offline with a general invitation to call or email.
• Keep it short and the same tone for good and bad reviews.

Templates that stay safe:

• Positive: "Thank you for taking the time to share this. We appreciate the kind words and hope to see you again."
• Negative: "Thank you for the feedback. We take every concern seriously. Because we protect our clients' privacy, we can't discuss details here, but we'd welcome a call at [phone] so the right person can help."
• Not a client, or you can't tell: use the negative template. It reads the same either way.

HIPAA-safe owner replies are part of the playbook we drafted for Elume. Whoever answers reviews should use templates like these rather than writing from scratch on a bad day.

A simple weekly routine

1. Check that the automated ask sent to every eligible visit from the past week. Look at the flow's recipients, not just its status.
2. Read new reviews and reply within a few days using your templates.
3. Report any review that breaks Google's policies, such as a fake or a competitor's review. Don't report a review just because it's negative.
4. Track two numbers: review requests sent and new Google reviews. If requests go up and reviews don't, test the email copy and timing before adding more channels.

Reviews also feed your local search visibility. If you're working on that side too, see our guides to Google Business Profile optimization and med spa SEO. If you'd like the whole system set up for you, that's part of our med spa marketing work.

Frequently asked questions