Med spa text message marketing: the consent rules, the 10DLC setup and 10 texts that book appointments

By Benjamin Chua·Published October 18, 2026·17 min read

A tattoo studio won't open the ink until you've signed the waiver. It says what they're going to do, how they'll reach you about touch-ups, and you sign it with your own hand before anyone touches you. Nobody thinks that's unfriendly. It's how a serious studio runs. Your SMS program is the same thing. Signed permission first, then carefully timed texts about the patient's slot, their follow-up and, if they said yes to it, your offers.

Most clinics have this backwards. They buy a texting tool, upload every number in the practice software, and send a flash special to all of it. Then they get filtered by the carriers, or a patient who never agreed to marketing texts forwards the message to a lawyer. The Telephone Consumer Protection Act (TCPA) allows statutory damages per message, and the federal rule that implements it treats a text as a call. This guide gives you the consent wording, the registration steps, 10 templates you can paste, and the numbers to watch, in the order you should set them up.

What are the TCPA rules for a med spa sending texts?

The federal rule is 47 CFR 64.1200. It's short enough to read, and the parts that matter for a clinic fit in a table. The official eCFR copy we read on 2026-10-18 carries an amendment note dated 29 August 2025 (90 FR 42138), so the text below is the current one as of that date.

The FTC's Telemarketing Sales Rule guide for businesses states the same hours window for telemarketing calls, 8am to 9pm local time at the location called, and describes an established business relationship that lasts 18 months after a purchase or 3 months after an inquiry. We read that guide on the same day. It doesn't settle how it applies to texts, so treat the TCPA rule above as the one you build around and let counsel tell you if the TSR adds anything in your state.

Operational or marketing: classify every text first

The consent standard turns on what the message is, so decide that before anyone drafts it. Operational texts are confirmations, reminders, waitlist updates and "your provider is running 10 minutes behind". Marketing texts are anything that sells: specials, discounts, memberships, win-back offers, "flash filler special". Marketing needs the signed written consent above. Reminders are generally treated as informational, which is a different consent question, but you still need the patient's permission to text that number at all.

The operational trap is mixing the two. You think it's a reminder because it has the appointment time in it. A court reads the "and ask about our membership" line at the bottom and calls it telemarketing. Keep reminders purely logistical. Put promotions only in clearly labelled marketing messages that go only to patients with marketing consent on file. The simplest way to avoid the argument is to collect written consent for all texting, from everyone, and still keep the two message types apart.

What should a med spa SMS consent form say?

One standard wording, used everywhere, never pre-checked. The wording has to name your clinic, say what kinds of texts you'll send, say automated technology may be used, say consent isn't required for treatment, give the opt-out and help keywords, and point to your privacy policy. This is the version we hand clinics, built on the Acquisition.com template and checked against the disclosure requirements in 64.1200(f)(9)(i):

1. 1

   Online booking page

   The checkbox sits directly above the Book button, unchecked. When ticked, your practice software or CRM stores four things: the consent flag, the source (online booking), the timestamp, and the version of the wording in force that day.

2. 2

   In-office intake form, paper or tablet

   Same disclosure above a signature line. Staff script, said out loud: "This lets us text you reminders and occasional offers. It's optional, and you can reply STOP anytime." Scan or save the signed form with the date.

3. 3

   Lead magnets, quizzes and ad forms

   Same disclosure as the form field right above the submit button. Then the first text is a double opt-in asking them to reply YES (template 1 below). Nothing promotional goes out until that YES is in.

Proof matters as much as the wording. If you're ever audited or sued, each patient record should show the exact number, the consent flag, the source, the timestamp, who or what recorded it, and which wording version applied. Keep PDFs or screenshots of every past version of your form so you can match the consent language to the date it was given. A consent you can't prove is a consent you don't have.

How does A2P 10DLC registration work for a med spa?

A high-security storage facility makes every tenant sign a contract and issues each one a gate code. Nobody drives in without a code, and every entry is logged. A2P 10DLC is the gate system for business texting in the US. Twilio's compliance page puts it plainly: "Anyone sending SMS/MMS messages over a 10DLC number from an application to the US must register for A2P 10DLC," and unregistered traffic "will receive additional carrier fees" and more filtering. The Campaign Registry, which runs the system, doesn't take registrations from businesses directly; you go through your messaging provider.

1. 1

   1. Pick a platform that handles the registry

   Your practice software's built-in texting, or a provider such as Twilio, Bandwidth or Telnyx. Ask one question before you sign: "Do you register our brand and campaigns with The Campaign Registry, and can we see the approval status?"

2. 2

   2. Gather the paperwork

   Legal business name as it appears on your tax registration, EIN, business address, website, a contact person, your industry category, and an honest estimate of monthly message volume.

3. 3

   3. Register the brand

   The brand is the clinic. Mismatched names between your EIN record and your form are the usual reason a brand fails verification.

4. 4

   4. Register the campaigns

   A campaign is a use case. Register at least two: Appointment Notifications and Promotional Offers. Twilio's page notes each brand may register up to five. Keeping marketing on its own campaign makes the operational-versus-marketing line visible to the carriers too.

5. 5

   5. Supply samples and opt-in language

   Paste your consent wording and two or three sample messages per campaign, including the STOP and HELP lines. Carriers read these.

6. 6

   6. Map numbers and test before volume

   Attach your clinic numbers to the approved campaigns, then send to five staff phones first. Only when every campaign shows approved and the test messages land do you send to patients.

Yes, even if you only send reminders. Carriers treat most business texting from 10-digit numbers as application-to-person traffic and expect the registration. Without it your appointment reminders are the first thing that gets filtered, and you'll find out from a wave of no-shows rather than an error message.

How do you handle opt-outs so one STOP covers everything?

The regulation says a patient can revoke by any reasonable method and you have at most 10 business days. Our working rule is same day, because nothing good happens in the gap. Two pieces of plumbing make that automatic.

“You're opted out of [SPA NAME] texts. You'll no longer receive messages from us. Reply HELP for help or call [PHONE].”

10 med spa text templates, with opt-out language built in

These are the Acquisition.com templates, edited for compliance and for how a clinic actually talks. Every marketing message carries "Reply STOP to opt out". Operational messages don't need it but it never hurts. Replace the brackets, keep the keyword replies, and send marketing ones only to patients with written consent on file. Where a template names a treatment, say the generic (wrinkle relaxer, filler, laser) rather than a brand, and never state a result.

Operational texts (confirmations, reminders, waitlist)

1. 1

   2. Appointment confirmation

   [FIRST], your [SERVICE] at [SPA NAME] is booked for [DAY] [DATE] at [TIME] with [PROVIDER]. Reply C to confirm or R to reschedule. Questions? Text here or call [PHONE].

2. 2

   3. 24-hour reminder

   [FIRST], reminder of your [SERVICE] tomorrow at [TIME] with [PROVIDER] at [SPA NAME]. Please reply C to confirm or R to reschedule so we can release your slot if needed.

3. 3

   4. 2-hour reminder, the no-show protector

   [FIRST], we're getting ready for you at [TIME] today. Still good to come in? Reply 1 for yes, 2 if you need to reschedule.

4. 4

   8. Waitlist confirmation

   You're on the [SPA NAME] waitlist for [SERVICE] with [PROVIDER]. We'll text you if a spot opens in the next [X] days. Please reply YES if you can come on short notice.

The confirmation and reminder set matches the structure the Acquisition.com Lead Nurture playbook recommends for show rates: automated reminders plus a human touch the night before and the morning of a high-value appointment (Lead Nurture playbook, pp. 35 to 36). If no-shows are your bigger problem right now, the med spa no-show fix covers the deposit and the 3-text sequence in detail.

Marketing texts (written consent required, opt-out on every one)

1. 1

   1. New-lead double opt-in

   Hi [FIRST], it's [SPA NAME]. You asked about [SERVICE]. We send occasional texts about openings, reminders and specials. Reply YES to confirm you want texts, or NO if not. Reply STOP to opt out at any time.

2. 2

   5. Post-visit review request

   [FIRST], thank you for visiting [SPA NAME] today. If you feel comfortable, would you share a quick review? It helps other patients find us. [REVIEW LINK]. Reply STOP to opt out of texts.

3. 3

   6. Post-visit membership tee-up

   [FIRST], based on today's plan, our [PLAN NAME] membership (monthly [SERVICE] plus [BENEFIT]) is the simplest way to keep up with maintenance. Want the details and pricing? Reply [KEYWORD] and we'll text you a 30-second overview. Reply STOP to opt out.

4. 4

   7. Dormant-patient reactivation

   [FIRST], it's [SPA NAME]. It's been a while since we saw you in [MONTH]. We've opened [N] spots this month for a maintenance visit with [PROVIDER]. Reply REFRESH to see times. Reply STOP to opt out.

5. 5

   9. Last-minute opening

   [FIRST], a [SERVICE] spot opened today at [TIME] with [PROVIDER]. Want it? Reply YES in the next 10 minutes and it's yours. If another day suits, reply LATER. Reply STOP to opt out.

6. 6

   10. Membership renewal nudge

   [FIRST], your [PLAN NAME] at [SPA NAME] renews on [DATE]. Members keep [BENEFITS]. If you'd like to review or adjust your plan before then, reply MEMBER and we'll text options. Reply STOP to opt out.

Three notes on the edits. Template 7 originally said "your [AREA] results are probably fading". We removed the treatment reference because a text preview sits on a lock screen, and naming what someone had done is a disclosure you don't need to make to get the booking. Template 6 originally said "most patients keep results best" on the membership; we cut it because it's a results claim. And the "[N] spots" in template 7 is only honest if the number is real. Scarcity you invented is a different compliance problem.

The reactivation text is the one that makes money fastest, because it goes to people who already trusted you with their face. The med spa patient reactivation guide turns it into a quarterly campaign with the segment rules and the follow-up sequence. For the review request, send it the same day as the visit and link straight to your Google profile; the Google Business Profile guide shows where to get that link.

How often should a med spa send marketing texts?

An amusement park fast-pass band is powerful because the guest chose it and can take it off. Send too much and they take it off. Our working rule: at most one broad marketing text per patient per week, plus narrow sends to small segments (the waitlist, the membership renewals due this month) as needed. Operational texts are per appointment: a confirmation and up to three reminders (booking, 24 hours, 2 hours). Offer a preferences choice, weekly promos, monthly only, or reminders only, and honour it.

Which SMS numbers should a med spa track?

Six numbers, tracked per campaign and reviewed monthly. The definitions are simple division, and the worked example below uses the illustrative figures from the Acquisition.com advisor, not a real clinic.

Put a dollar figure next to the booking rate. If those 46 shows carry a $450 average ticket, that one reactivation text produced about $20,700 in treated revenue for the cost of 1,200 messages. Your numbers will differ. Review copy, timing and segment each month, and kill or rewrite anything that books poorly or spikes opt-outs. Sending more of a campaign that doesn't book is the SMS version of boosting a post that isn't working.

What do the sales playbooks say about text marketing?

Every text is a tiny offer, so the Value Equation applies: raise the dream outcome and the perceived likelihood, shrink the time delay and the effort (Hormozi, $100M Offers, p. 59). "Reply 1 for a same-week spot" asks for one keystroke and promises a date. "Call us sometime to book" asks for a phone call and promises nothing. The reply-keyword structure in every template above is that idea applied.

Perceived likelihood is why a small, true proof line lifts a promotional text (Hormozi, $100M Offers, p. 65). "Over 300 members on this plan" works if you have 300 members. If you have 40, say 40, or say nothing. The claim has to be yours and provable.

For a slow book, the Rule of 100 (Hormozi, $100M Leads, pp. 155 to 156) translates to a manual texting sprint: 100 personal texts a day to warm leads, past patients and old inquiries who have consented, for 100 days, each with a specific offer. Manual texts from the desk phone also read differently from a blast, and the reply rate usually shows it. The Lifetime Value playbook's quarterly reactivation promos to lapsed customers (Lifetime Value playbook, p. 16) are the cadence behind template 7, and the Lead Nurture playbook's show-up structure (Lead Nurture playbook, pp. 35 to 36) is behind templates 2 to 4.

The five most expensive SMS mistakes

1. 1

   Texting without real written consent

   Cost: statutory damages per message and carrier blocking. Fix: stop every promotional text until you have signed or electronic consent with the wording above, then run a re-permission campaign by email and at the desk to rebuild the list properly.

2. 2

   Mixing marketing into operational texts

   Cost: you think it's a reminder, a court calls it telemarketing. Fix: reminders are logistics only. Promotions go in labelled marketing messages to marketing-consented patients, on their own 10DLC campaign.

3. 3

   Ignoring or narrowing opt-outs

   Cost: complaints, lawsuits and higher carrier filtering. Fix: any STOP-like word or a spoken "stop texting me" is a global opt-out from marketing. Suppress the same day and log the date.

4. 4

   Blasting too often

   Cost: unsubscribes and spam reports, which the carriers see. Fix: cap broad promos at one a week, watch unsubscribe rate per send, and move to smaller behaviour-triggered sends (only people who clicked the membership email, only members renewing this month).

5. 5

   No tracking by campaign

   Cost: you keep sending because it feels busy, with no idea what books and what annoys. Fix: for each campaign log sent, delivered, replies, bookings, shows and opt-outs. Kill or rewrite anything that underperforms on booking rate or spikes opt-outs.

Texts work best when the patient already knows you

A reactivation text to someone who has watched your injector explain treatments on Instagram for a year gets a reply. The same text to someone who booked once from a discount and never saw you again gets STOP. SMS is the last step of a relationship your content built. If you want the content side planned out, the free 12-month content plan at /free-plan maps a year of posts from one filming day, and if the price question arrives by DM more than by text, the wrinkle relaxer price reply scripts cover the written answers.

Where this comes from

• 47 CFR 64.1200 (Delivery restrictions), official eCFR copy read 2026-10-18, latest amendment note 90 FR 42138, 29 August 2025. All quoted rule text in the TCPA table is from this section. The right-hand column of that table is our reading, not legal advice.
• FTC, Complying with the Telemarketing Sales Rule, read 2026-10-18, for the 8am to 9pm window and the 18-month and 3-month established business relationship periods.
• The one-to-one consent vacatur (January 2025) and the revoke-all delay to 31 January 2027 are as reported by law-firm summaries; the FCC's own pages returned errors on 2026-10-18 and were not read. Status to confirm.
• Twilio, Programmable Messaging and A2P 10DLC, page dated 2026-07-07, read 2026-10-18, for the registration requirement, carrier fees on unregistered traffic and the five-campaign limit. The Campaign Registry homepage, read 2026-10-18, for brands registering through a messaging provider rather than directly.
• 45 CFR 164.501 (definition of marketing) and 45 CFR 164.508 (authorisation for marketing), eCFR, read 2026-10-18. The HIPAA callout is our reading and should be checked by your privacy officer or counsel. HHS guidance pages could not be loaded.
• The consent wording, templates, frequency rule, KPI formulas, worked example and five mistakes come from the Acquisition.com advisor, edited for compliance and voice. Hormozi references with page numbers as given there: $100M Offers pp. 59 and 65 (Value Equation, perceived likelihood), $100M Leads pp. 155 to 156 (Rule of 100), Lead Nurture playbook pp. 35 to 36, Lifetime Value playbook p. 16.
• Working rules, not published standards: same-day opt-out suppression, 9am to 7pm send window, one broad promo a week, up to three reminders per appointment, unsubscribe rate under 1%, delivery under 90% as a warning. The 2,000-patient worked example and the $450 ticket are illustrative.
• Not read, so not relied on: CTIA Messaging Principles and Best Practices (certificate error), FCC consumer guides (403), state mini-TCPA statutes. Check your own state's texting law before launch.

Questions owners ask

Written by Benjamin Chua

Founder of Trueframe and Med Spa Launch. Nine years building video systems for founders and clinics, including a Melbourne plastic surgeon whose account went from 12,043 to 36,236 followers in ten weeks.