med spa compliance • us, uk, ireland

Med Spa Website Compliance Basics: US, UK and Ireland

Med spa websites must not use fake or misleading reviews, must back up any health or results claims, and should show only before-and-after results clients can generally expect; in the UK and Ireland, botulinum toxin is a prescription-only medicine and cannot be promoted to the public, even on your own website. This page sets out the main rules by country with links to the official guidance, so you can check your site and know what to ask your adviser.

I build websites, not legal opinions. Everything here links to the regulator's own guidance, and rules differ by state and profession, so treat this as a map of what to check, not the final word.

By Ali Murtaza, PrimeBuildLast updated: 19 October 2026

Free homepage demo in 48 hours Med Spa Website Design

01 • united states • reviews

What are the FTC rules on med spa reviews and testimonials?

The FTC's Consumer Reviews and Testimonials Rule took effect on 21 October 2024. It applies to med spas like any other business.

No fake reviews or testimonials, including ones written by staff or AI and presented as client reviews (§465.2).
No paying or rewarding clients for reviews that must be positive (§465.4).
Reviews by owners, staff or their relatives must disclose that connection (§465.5).
No suppressing negative reviews through threats or by hiding them while claiming to show all reviews (§465.7).
No buying fake followers, likes or views to look more popular (§465.8).

Asking every client for an honest review is fine. Asking only happy clients, then presenting the result as 'all our reviews', is where it gets risky.

02 • united states • claims and photos

What claims and before-and-after photos can a med spa use?

The FTC's Health Products Compliance Guidance (December 2022) says health claims need competent and reliable scientific evidence, and that testimonials reporting results more dramatic than users can generally expect are likely to be deceptive. A 'results not typical' disclaimer does not fix that.

The FTC's endorsement guides (16 CFR 255.2) say that if a testimonial is not representative, the advert must clearly disclose the generally expected results, in a way that changes the overall impression.

Safer practice

Before-and-afters that reflect typical results, with written consent
Same lighting, angle and timing in both photos
Noting the number of sessions and time since treatment
Describing what a treatment is designed to do

Higher risk

Only your most dramatic results
Edited or filtered photos
'Guaranteed results' or 'permanent' claims you cannot prove
'Results not typical' as a cover for unusual results

03 • united states • privacy

Does HIPAA apply to my med spa website?

Only if your practice is a HIPAA covered entity. HHS says healthcare providers are covered when they electronically submit standard transactions, such as insurance claims. A cash-only med spa may not be covered; one that bills insurance for some services probably is.

On tracking tools: in June 2024 a federal court in Texas (AHA v. Becerra) vacated part of HHS's guidance on online tracking technologies, the part about tracking on public pages that do not require login, and HHS dropped its appeal in August 2024. That ruling was narrow. Tracking on booking or patient pages that collect health information can still be a problem, and state privacy laws may apply whether or not HIPAA does.

Privacy checks for your site

Find out if you are a covered entity
If so, link your Notice of Privacy Practices
Keep booking forms to what you need
Review which tracking pixels run on booking and form pages
Have a website privacy policy either way

04 • united kingdom

Can a UK med spa advertise Botox on its website?

No. Botulinum toxin is a prescription-only medicine, and the CAP Code (rule 12.12) bans advertising prescription-only medicines to the public. The ASA's guidance makes clear this includes your own website and social media.

Promote the consultation, not the product. Wording such as 'a consultation for the treatment of lines and wrinkles' is likely to be acceptable.
A prescription-only medicine may be mentioned only as a possible option after a consultation, not on the homepage, in ads, logos, testimonials or hover text.
Avoid indirect references such as 'Beautox', syringe imagery suggesting injectables, or a separate 'anti-wrinkle treatment' page that stands in for Botox.
Price lists that include such treatments are allowed, but must not make product claims or encourage choosing a product on price.
Before-and-after photos for these treatments are likely to be seen as efficacy claims and should be avoided.

05 • ireland

What are the rules for Irish aesthetic clinics?

In its statement of 3 April 2024, the HPRA confirmed that medicines containing botulinum toxin are prescription-only, and said it had asked 135 clinics advertising botulinum toxin online to remove content that breached the laws on promoting prescription-only medicines.

The HPRA also advised the public to make sure procedures are carried out by a registered doctor or dentist, or a registered nurse working under their direction, after a consultation. For your website, the practical lesson is similar to the UK: promote consultations and your qualified team, not the medicine.

06 • check your site

How do I check my med spa website for compliance?

Website compliance check

Every review is real and unedited
Staff or family reviews are disclosed
Before-and-afters show typical results, with consent
No 'guaranteed' or unproven claims
Financing adverts follow Regulation Z if you state terms
HIPAA status known, and privacy notices linked
UK/Ireland: no prescription-only medicine promoted to the public
A qualified adviser has reviewed treatment pages

Once the content is right, make sure the rest of the site works: see the med spa website must-haves.

Want a homepage built with these rules in mind from the start? I will design one for your med spa in 48 hours, free.

Free homepage demo

before you pay anything

Free homepage demo in 48 hours

I design a new homepage for your business. You see it first. You only pay if you want the full website.

questions

Frequently asked questions

01. Can I advertise Botox on my med spa website?

In the UK and Ireland, no: it is a prescription-only medicine and cannot be promoted to the public. In the US, there is no equivalent blanket ban, but claims must be truthful and substantiated, and state rules apply.

02. Are before-and-after photos allowed?

In the US, yes, with consent, if they show results clients can generally expect. In the UK, for prescription-only treatments, the ASA says they are likely to be seen as efficacy claims and should be avoided.

03. Can my staff leave reviews for the clinic?

Under the FTC rule, reviews by owners, staff or their relatives must clearly disclose that connection.

04. Does HIPAA apply to every med spa?

No. HHS says a provider is covered if it electronically submits standard transactions such as insurance claims. Check your status with a compliance adviser.

05. Is this legal advice?

No. It is general information with links to official guidance. Rules differ by country, state and profession, so have a qualified adviser review your site.

Sources

Checked on 19 October 2026. Pages change, so read the current version before you act.