Med spa influencer marketing under the FTC endorsement rules: how to work with creators and patients the right way, from first DM to tracked booking

By Benjamin Chua·Published October 19, 2026·16 min read

Every piece of creator content is a traveller in an airport security line. Nobody gets waved through because they seem nice. Everyone walks through the same metal detector (your written policy), puts their bag through the same scanner (your review before posting) and some get a random check (your monthly audit). The line is boring. The plane stays in the air.

That is the whole model for influencer marketing in an aesthetic clinic. The creator posts from her own account, but the FTC treats the post as your advertising. The Endorsement Guides put it plainly: "Advertisers are subject to liability for misleading or unsubstantiated statements made through endorsements" (16 CFR 255.1(d)). If a creator says a wrinkle relaxer erased her lines forever, that claim is yours. If she got a free syringe of filler and the caption reads like unprompted praise, that hidden connection is yours too. This guide gives you the process that keeps the upside (real people telling real stories about your clinic) without those two problems, with the scripts, the clauses, the forms and the tracking sheet included. The wider rulebook for med spa advertising lives in our med spa marketing compliance guide; this one goes deep on creators and patients.

What do the FTC rules say about med spa influencers?

Two documents cover almost everything. The first is the Endorsement Guides, 16 CFR Part 255, which define an endorsement as "any advertising, marketing, or promotional message for a product" that consumers would read as the speaker's own view (255.0(b)). A creator's reel about her lip filler appointment is an endorsement. So is a patient's quote on your website.

The second is the FTC's plain-English page, Disclosures 101 for Social Media Influencers. It tells creators to "Disclose when you have any financial, employment, personal, or family relationship with a brand" and that "The disclosure should be placed with the endorsement message itself." The Guides say the same thing in regulatory language: a material connection "must be disclosed clearly and conspicuously" (255.5(a)), and "Material connections can include a business, family, or personal relationship."

There is one more line that matters for clinics specifically. Consumer stories are not evidence. The Guides state that "Consumer endorsements themselves are not competent and reliable scientific evidence" (255.2(a)), and the FTC's Health Products Compliance Guidance asks for "adequate substantiation for all objective product claims conveyed, expressly or by implication." A creator saying "I feel more confident" is her experience. A creator saying "this gets rid of wrinkles for six months" is an objective claim you need to be able to back, and a happy patient does not count as backing.

Is a comped treatment a material connection?

Yes. This is the question that trips up most clinics, because a free syringe feels like hospitality rather than payment. The FTC does not see a difference. On its Endorsement Guides FAQ page the agency answers whether a disclosure is needed when the only thing received was a free product with a flat "Yes." The Disclosures 101 page lists a financial relationship as anything of value, and the Guides' own example about a doctor promoting a product says "the post should clearly and conspicuously disclose the doctor's connection with the company" (255.5(b)(4)(ii), Example 4).

Our working rule: treat any free or discounted service as paid. Fifty dollars off a facial is a connection. A gifted peel is a connection. A standing 20 percent creator rate is a connection. Write the fair market value of every comped treatment into the agreement in dollars so nobody can later argue it was a favour between friends.

“I received complimentary treatment at [Clinic] for sharing my honest experience. This is an ad. Everyone's experience is different, so talk to a qualified provider about what's right for you.”

Notice what the caption does. It names the clinic, says the treatment was free, says the post is an ad, and ends with a line that steers viewers to a consult rather than a result. The creator can write it in her own words. The four facts stay.

How should the disclosure look on Instagram and TikTok?

The FTC's Endorsement Guides FAQ page answers the format questions directly, and we read it on 2026-10-18. On wording, "Starting a post with 'Ad:' or 'Paid ad' or '#ad' or 'Advertising:' or 'Advertisement' would likely be effective." On placement in an Instagram caption, "any required disclosure should be presented without having to click 'more.'" On relying on the platform's own tool, the answer is "Not necessarily," and the page adds that "just because a platform offers this feature is no guarantee that it's an effective way" to disclose. Disclosures 101 says the same thing more bluntly: "Don't assume that a platform's disclosure tool is good enough."

So the stack is both. Instagram's paid partnership label (check the current requirements in the app, Meta's help pages did not load when we researched this) turned on, and a plain-language disclosure in the first line of the caption. On video, the creator also says it out loud in the first few seconds, because many viewers never read the caption. A "thanks [Clinic]" or an "ambassador" tag on its own is treated by Disclosures 101 as not enough.

The three policies to lock before the first DM

Write these three down, have your attorney read them once, and get every team member who touches social media to sign the page. Most creator problems come from a receptionist with good intentions and no rule to follow.

1. 1

   No medical claim without clinician sign-off

   Any statement about what a treatment does, how long it lasts or who it suits is reviewed by the injector or medical director before it posts. Feelings are fine. Outcomes are claims.

2. 2

   No post goes live without a disclosure

   Any payment, free service, discount or gift is disclosed in the post itself, and the platform's label is turned on. Both, every time.

3. 3

   No patient content without signed authorization

   A signed HIPAA marketing authorization plus a photo and video release, logged in one sheet, before any patient's face, name, voice or story appears anywhere. Verbal consent does not count.

How do you pick creators who won't get you in trouble?

Start with three to five local micro-creators. Skip the celebrity with a national audience; her followers are in forty cities and none of them can book with you. Our working criteria:

• Location: at least 70 percent of her audience within about 25 miles of your clinic. Ask for a screenshot of her audience insights, do not take her word for it.
• Niche: beauty, lifestyle, local things-to-do, or a professional your ideal patient already follows (a stylist, a trainer, a realtor).
• Size: 3,000 to 50,000 followers as a working range. Small enough to care about one clinic partnership, big enough to move bookings.
• Content history: no medical claims, no drama, no posts you would be embarrassed to be tagged in.
• Audience fit: adults in the age range and income band your treatment menu is built for.

The outreach DM and the 15-minute call

Lead with the word paid and the word ad in the first message. It filters out creators who want a quiet freebie and tells the serious ones you know the rules.

“Hey [Name], I run [Clinic] in [City]. We help [who] feel [non-medical result, e.g. more confident on camera]. I'd love to explore a paid collaboration or comped treatment where you document your honest experience, clearly marked as an ad. Open to a quick chat?”

“Awesome. Before we talk details, can you share a screenshot of your audience insights (age, city), confirm you're comfortable using #ad and the paid partnership label and following FTC rules, and confirm you're okay with us reviewing posts before they go live?”

If she agrees to all three, book a 15-minute call. The call has four parts and a single goal: she leaves knowing compliance is part of the job, and you leave knowing whether you want her on camera.

1. 1

   Open, 2 minutes

   "We're a medical aesthetics practice, so compliance isn't optional for us. We want you to share your real experience, within some simple rules so patients and regulators aren't misled."

2. 2

   Fit questions, 5 minutes

   "Tell me about your audience. Who interacts most?" "Have you done sponsored work before? Any healthcare brands?" "Are you comfortable showing treatment steps, needles and so on?" "Any hard lines on what you won't post?"

3. 3

   Compliance frame, 5 minutes

   "We follow the FTC endorsement rules and HIPAA. You'll always disclose if you're paid or comped. We'll give you the exact wording and which platform tools to switch on, and you post from your own account." Then: "No guaranteed results, nothing like 'permanent' or 'risk-free'. If in doubt, we cut it."

4. 4

   Next step, 3 minutes

   "If we send over our one-page brief and the agreement, are you comfortable reviewing them and, if it looks good, signing this week?"

What goes in the influencer agreement?

A handshake deal has no disclosure clause, no usage rights and no exit. Get a template drafted once by your attorney and reuse it. These are the seven sections it needs:

1. 1Deliverables. Number and type of posts (for example 2 Reels, 3 Stories, 1 TikTok), deadlines, and the review window before each one.
2. 2Compensation. Cash, comped treatment or both, with the fair market value of any comped service written in dollars. Pay a flat fee for the deliverables.
3. 3Disclosure and FTC compliance. She uses your disclosure wording and the platform tools on every post, and acknowledges in writing that a free or discounted treatment is a material connection.
4. 4HIPAA and privacy. You will not share her medical details without her specific written authorization. If she is also a patient, she signs a separate HIPAA marketing authorization.
5. 5Approvals and usage rights. You review drafts before posting. If agreed, you may reuse her content on your channels and in ads, with the sponsorship disclosure kept on it.
6. 6Claim restrictions. No off-label uses, no promised results, no comparing your results to a named competitor, no health claims the clinician has not approved.
7. 7Termination. You can end the agreement for non-compliance or reputational risk, and require removal of non-compliant posts.

What about patients as creators? The HIPAA authorization

Many of your best creators will also be your patients, and some patients will become creators the moment you ask them to share. That switches on a second rulebook. Under the HIPAA Privacy Rule, "a covered entity must obtain an authorization for any use or disclosure of protected health information for marketing" (45 CFR 164.508(a)(3)), and where the clinic receives payment from a third party for the communication, "the authorization must state that such remuneration is involved" (164.508(a)(3)(ii)). A patient's face in your before-and-after, her name in a caption, the fact that she had a treatment at all: each is protected health information once you are a covered entity. Whether your med spa is one depends on how you bill, so confirm that with counsel, and our working rule is to behave as if you are.

Never use a face, name, voice or story if a lawyer looking over your shoulder would not instantly see the signed form. The process:

1. 1

   Ask separately from care

   At checkout, never in the treatment room: "Separate from your treatment, we sometimes feature patient stories on our social media. It's completely optional and won't affect your care. Would you like more information?"

2. 2

   If yes, present two forms

   A HIPAA marketing authorization that states what you will use (photos, video, quotes), where it may appear (website, ads, social), whether anyone is paying for the content, and that she can revoke later for anything not yet used. Plus a separate photo and video release. Have counsel confirm the forms meet HIPAA and your state's requirements.

3. 3

   Capture honestly

   Same lighting, angle and expression for before and after. No filters that change skin texture or shape. She talks about how she feels, not what the treatment did. The full checklist is in our before-and-after photo rules.

4. 4

   Log it

   One sheet: name, date, procedure, forms signed (yes or no), where used, date of any revocation. Audit it monthly.

The content brief: a flash wall, not a blank page

A tattoo shop does not let a walk-in design a full back piece on the spot. It gives them a wall of pre-approved flash and lets them add their own colour. Your one-page brief is that wall. Creators pick from safe angles and approved phrases and bring their own personality, instead of inventing a claim in the car park. Send this to every creator with the agreement:

1. 1

   Campaign goal

   One line. For example: 20 consults attributed to your code inside 30 days.

2. 2

   Service and audience

   The treatment (lip filler, wrinkle relaxer, skin tightening) and who the ideal viewer is: age range, concern, budget. Adults only in every example.

3. 3

   Approved messages

   "Natural-looking results." "Experienced injectors" (board certification only if it is true for the provider shown). "An in-person consult decides whether you're a candidate."

4. 4

   Do-not-say list

   Permanent, guaranteed, risk-free, reverses ageing, any disease claim, any brand name used for an unapproved purpose, any advice on who should get treatment. The line is always "talk to your provider".

5. 5

   Disclosure requirements

   The exact caption wording, the hashtags (#ad or #sponsored, plus gifted where it applies) and the paid partnership label switched on.

6. 6

   Formats and counts

   For example: one getting-ready Reel, one treatment-day Reel, one one-week check-in Reel, three Stories per posting day with the link sticker.

7. 7

   Review process

   "Send drafts via [email or shared folder] at least 48 hours before posting. We reply within 24 hours with Approved or edits." Working targets; adjust to what your desk can keep.

8. 8

   Call to action and tracking

   "Book a consult at [short link] and mention code [CREATORNAME] so we know who sent you." One unique link and code per creator.

The treatment-day Reel is also where product names get risky. If the creator films a wrinkle relaxer appointment and names the brand, the post is now promoting a prescription product, and the three approved cosmetic uses are the only ones that can be named. Our guide to advertising neuromodulators on Instagram and Facebook covers that line, and Meta's own health restrictions on top of it.

How do you track bookings per creator?

A fire alarm system does not rely on someone smelling smoke. There is a detector in every room, each one gets tested, and every alarm is logged. Treat creator tracking the same way. Three layers, so a missed code in one place is caught in another.

1. 1Unique code per creator, for example JESSVIP. Front desk and phone script: "Did you see us through a creator or influencer? If so, who, or what code did you use?"
2. 2Unique link per creator, for example yourclinic.com/jess, with hidden UTM fields on the booking form so the source lands in the record without the patient typing anything.
3. 3One sheet in your CRM or a spreadsheet, filled in at booking and updated after treatment.

Each week, run two lines per creator. Creator net profit is revenue from her patients, minus the direct cost of treating them, minus what she cost you (cash fee plus the fair value of anything comped). Creator ROI is that net profit divided by her cost. Using the illustrative month above: $6,000 revenue, $1,800 direct treatment cost, $1,100 creator cost. Net profit is $3,100. ROI is $3,100 divided by $1,100, or about 2.8. She stays.

Our working keep-or-kill line is an ROI under 1.5 for two months running. Pause that creator, thank her properly, and test the next name on the shortlist. The threshold is a starting point. Once you have six months of your own numbers, set it from them.

Five expensive mistakes

• No written agreement. Handshake deals have no disclosure clause, no usage rights and no exit. Fix: the seven-clause template above, reviewed once by your attorney.
• Creators making medical claims. "This erased all my wrinkles forever" is your claim once it is posted. Fix: the do-not-say list, a safe-phrasing sheet, and pre-approval on every sponsored post.
• Patient images without authorization. A team member grabs a great photo and posts it on verbal consent. Fix: signed HIPAA authorization and release logged before anything is shared, audited monthly.
• Hidden compensation. Gifted filler, a caption that reads like pure organic praise. Fix: treat all value as payment and require the disclosure even for a discount.
• No tracking by creator. You keep the one who feels like she is working and drop the one who is. Fix: codes, links, the intake question and the weekly profit line.

What the playbooks say about proof

The reason to put up with all this process is that creator content is proof, and proof sells aesthetics better than claims do. Hormozi's value equation puts perceived likelihood of success at the centre of what people will pay for ($100M Offers, p. 59 and p. 65), and a creator who looks like your patient, filmed in your chair, raises that likelihood without a single promise from you. His point that perception is reality ($100M Offers, p. 61) is why the raw day-of footage and the honest one-week check-in change how safe the clinic feels, even though nothing about the procedure changed.

The same books treat transparency as risk reversal: proof, over-disclosure instead of hype, and promises about communication and follow-up rather than outcomes ($100M Offers, p. 124, p. 126 and p. 135). The Acquisition.com Proof Checklist playbook adds that phone-shot, lightly edited testimonials usually beat staged commercials (p. 14), that the best ads are often just proof (p. 21 and p. 31), and that a wall of varied proof compounds in a way one hero ad never does (p. 21). Three to five creators, each with a Reel and a check-in, plus the patients who sign up to share, is that wall. The disclosure in the first line is what lets you keep it up.

If the creator calendar is the part you would rather not build from a blank sheet, the free 12-month content plan maps the year of clinic posts the creator content slots into, and our one-day content shoot guide shows how to film the clinic side of it in a single day.

Where this comes from

• FTC Endorsement Guides, 16 CFR Part 255, read on eCFR (current as of 2026-10-01, fetched 2026-10-18). Quotes are from 255.0(b), 255.1(d), 255.2(a) and 255.5(a) and (b)(4)(ii).
• FTC Disclosures 101 for Social Media Influencers (page shows November 2019, fetched 2026-10-18).
• FTC Endorsement Guides: What People Are Asking (FAQ page, fetched 2026-10-18) for the free-product, #ad, "more" and platform-tool answers.
• FTC Health Products Compliance Guidance (fetched 2026-10-18) for the substantiation line.
• FTC Consumer Reviews and Testimonials Rule, 16 CFR Part 465, read on eCFR (fetched 2026-10-18) for the staff-review disclosure point.
• HIPAA Privacy Rule, 45 CFR 164.508(a)(3), read on eCFR (current as of 2026-10-01, fetched 2026-10-18). The HHS marketing guidance page did not load, so nothing is quoted from it.
• Meta's branded content and paid partnership help pages did not load, so no Meta policy is quoted. Check the current label requirements inside the Instagram app.
• Hormozi and Acquisition.com references ($100M Offers pages 59, 61, 65, 124, 126, 135; Proof Checklist playbook pages 14, 21, 31) are as cited by the Acquisition.com advisor and not independently re-read for this post.
• Working rules, not published standards: 3 to 5 creators, 3,000 to 50,000 followers, 70 percent local audience within 25 miles, score of 20 out of 25, 48-hour draft window, 24-hour reply, ROI under 1.5 for two months. The dollar figures in the tracking example are illustrative.
• Whether a med spa is a HIPAA covered entity, and how your state treats per-patient payments to creators, are legal questions for your counsel. This post is our reading, not legal advice.

Questions owners ask

Written by Benjamin Chua

Founder of Trueframe and Med Spa Launch. Nine years building video systems for founders and clinics, including a Melbourne plastic surgeon whose account went from 12,043 to 36,236 followers in ten weeks.