--- title: "How do I choose med spa software?" description: "Choose med spa software by the jobs your team does every day, test it on your own cases, and get a signed business associate agreement if HIPAA applies." url: https://aevadigital.com/learn/how-to-choose-med-spa-software --- 1. [Home](/) 2. [Learn](/learn) 3. Choosing med spa software Practice software # How do I choose med spa software? Choose software by the jobs your team does every day: booking, intake, charting, checkout and texting. Then test each system on your own cases. If HIPAA applies, get a signed business associate agreement. This is the list we'd use at Elite Beauty. [Book a demo](/book-a-demo) Jeff writes from first-hand experience running a med spa. ## What you will learn - Which daily jobs your software has to cover, from booking to texting - What HIPAA expects from a software vendor, and what to ask for - Why one patient record saves your team from typing things twice - What switching involves, including the texting registration US carriers require ## On this page - [How to choose, phase by phase](#how-to-choose) - [What jobs should the software handle?](#daily-jobs) - [Why does one patient record matter?](#one-record) - [What does switching systems involve?](#switching) - [Quick answers before you decide](#faq) The framework ## What are the steps to choosing med spa software? - ### Map the work Write down what your team does each day: booking, intake forms, charting, checkout, memberships, texting and campaigns. Next to each job, note which tool handles it now. - ### Check the rules If HIPAA applies to you, ask each vendor for a signed business associate agreement. Make sure every login can be limited to what that person needs. - ### Test your cases Pick a few visits from last week, swap in made-up names and details, and bring them to every demo. Have the vendor run each one live. - ### Plan the move Ask who moves your patient list and appointment history, what training covers, and how long business texting takes to switch on. ## What jobs should med spa software handle each day? At Elite Beauty, the software is open all day at the front desk and in the treatment rooms. On a normal day we use it to take online bookings, send intake and consent forms, chart treatments and photos, check patients out and text them. We also use it to sell packages and monthly memberships, run text and email campaigns, and ask for a Google review after every visit. Write your own version of that list before the first demo. Otherwise you'll end up grading each vendor on the screens they chose to show you. If HIPAA applies to your practice, it also covers any vendor that handles patient health information for you. HHS guidance says a cloud company that keeps patient health information for you counts as a business associate, even if all it stores is encrypted data. The HIPAA rules then require a written agreement with that vendor before you hand anything over. So ask for the signed business associate agreement while you're still comparing vendors. Source: HHS Office for Civil Rights, Guidance on HIPAA and Cloud Computing, October 2016. ### Sources - [HHS Office for Civil Rights, HIPAA and cloud computing guidance, October 2016](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html) - [eCFR, 45 CFR 164.502(e), read October 2026](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-E/section-164.502) - [eCFR, 45 CFR 164.312, read October 2026](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.312) - [Twilio, A2P 10DLC developer documentation, read October 2026](https://www.twilio.com/docs/messaging/compliance/a2p-10dlc) ## Why does one patient record matter for a med spa? One patient record means the booking, the payment, the package, the campaigns and the texts all land on the same profile. When those jobs are spread across separate tools, somebody ends up copying details from one into another, and sooner or later the copies stop matching. Think of a package someone paid for at checkout that nobody sees at the next visit, or a patient who gets a promo text for a treatment they had yesterday. That's why we run every one of those jobs on AEVA, charting and consents included. Our front desk books on the same record our providers chart on, so an allergy note or a signed consent is there for everyone who needs it. Nobody on our team retypes a patient's details from one tool into another. There's a security side too. The HIPAA Security Rule requires a unique ID for each user and access only for people who've been granted it. It also requires a record of activity in systems that hold patient data. Every extra tool is another set of logins to manage and another activity log to check, so count that when you choose. Source: eCFR, 45 CFR 164.312, HIPAA Security Rule technical safeguards, read October 2026. Key point Each time someone copies a patient detail from one tool into another, the two records can drift apart. One system Every job writes to one record Patient record One profile Booking Intake forms Charting Checkout Texting Separate tools The same jobs, kept in sync by hand Booking tool Intake forms Charting Checkout Texting app Copied by hand Each copy can drift from the others One patient record in the middle, with booking, intake forms, charting, checkout and texting each writing to it. Next to it, the same jobs spread across separate tools that staff keep in sync by hand. ## What does switching to new med spa software involve? Switching means moving your patient list and appointment history over, training your team, and getting texting working again. Ask the vendor which of those they handle and which fall to you. Give texting its own line in the plan. According to Twilio, anyone texting US patients from an app over a regular ten-digit number has to register under A2P 10DLC, the carriers' standard. Build in time to test it before go-live. We've run Elite Beauty on AEVA since we opened, so we never had to migrate. For a practice that does, the AEVA process goes like this. The practice signs up and submits its business details for texting. Then the team meets with the practice to learn how it runs, builds to those needs, and trains the staff. The practice can start right away, though texting can take up to a week to switch on. It can import its own data, or the AEVA team can do it. Source: Twilio, A2P 10DLC developer documentation, read October 2026. Example ![Practice OS patient record with personal info, a package, consents, and membership](/_astro/practice-os-patient-record.BBpKS-7Y_Zqavmh.webp) Practice OS, patient record. Demo data. One patient's visits, consents, package, membership and payments sit on a single contact card in Practice OS. Consents lock once signed. ## See one record in action Practice OS runs scheduling, charting, payments, memberships and patient texting on one patient record. You can see how those pieces connect on the Practice OS page. [Explore Practice OS](/platform) By [Jeff Woodrow](/about/jeff-woodrow), AEVA co-founder and med spa owner FAQ ## Quick answers Short answers on agreements, demos, data, texting and quotes before you pick practice software. Does med spa software need a business associate agreement? If HIPAA applies to your practice, yes. HHS guidance says a cloud vendor that keeps patient health information for you is a business associate, even if it only stores the data encrypted. [Read the HHS guidance](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html) What should I test during a software demo? Bring a visit from last week with made-up details. Have your staff follow it from booking to checkout to the thank-you text and review request. Watch where they switch tools or type something twice. Who should move my data? Decide who prepares the export, who runs the import and who checks it. Ask the vendor to show a sample import before you commit to moving everything. When can texting start? It depends on registration. Twilio says texts sent from an app to US numbers over a regular ten-digit number need A2P 10DLC registration. Ask your vendor for a test date. How should I compare software quotes? Get each quote in writing for the jobs on your list. Compare setup, data import, training and ongoing costs, then ask what changes when you add providers. Try - [Do you work with dental offices?](/contact?q=Do%20you%20work%20with%20dental%20offices%3F) - [How fast can we launch?](/contact?q=How%20fast%20can%20we%20launch%3F) - [How does Practice OS connect to my EMR?](/contact?q=How%20does%20Practice%20OS%20connect%20to%20my%20EMR%3F) ## Test it on a real day Pick software by the jobs your team does daily and the one record it keeps. Then bring your own cases, with made-up details, to every demo. [Book a demo](/book-a-demo) [sales@aevadigital.com](mailto:sales@aevadigital.com) [1-833-4-MYAEVA](tel:+18334692382)