A med spa's staff chat has to handle three things a dental office never sees: before-and-after photos, an off-site medical director, and owners who are not clinicians. WhatsApp groups handle all three badly and sign no Business Associate Agreement (BAA). A channel-based tool with a BAA, private channels for the clinical side and a strict photo rule fixes it for $10 a month per location.
Why med spas end up on WhatsApp
Injectors move between two locations. The medical director is a physician who is rarely on site. The owner runs the business from a phone. Front desk coordinators book consults and chase deposits. Everyone already has WhatsApp, the photo sharing is good, and the group gets created the week the spa opens. A year later it holds hundreds of client photos, consult notes and lot numbers, on every phone of everyone who ever worked there, with no way to remove a single one of them.
The photo part is what makes med spas different. In most practices, PHI is text. In a med spa it is faces.
What counts as PHI in a med spa
Protected health information (PHI) is any detail that identifies a person and relates to their health, treatment or payment. A med spa that provides medical treatments and keeps charts should treat itself as a covered entity, the HIPAA term for a provider that must protect PHI. Cash-pay spas that fall outside the strict definition still face state privacy laws and client expectations that are just as unforgiving about a leaked photo. Either way, a vendor handling that information for you should sign a Business Associate Agreement (BAA), the contract in which the vendor accepts HIPAA obligations.
| Message or file | PHI? | Why |
|---|---|---|
| Before-and-after photo with the face visible | Yes | A face identifies a person; the treatment is health information |
| "Ms. Rivera, 2 syringes cheeks, lot 4471B" | Yes | Name plus treatment plus product |
| "Room 1 is ready" | No | No client identifier |
| Consult note photographed and sent to an injector | Yes | The chart itself |
| "Downtown is out of 30-gauge needles" | No | Inventory, not a client |
| Membership payment question with the client's name | Yes | Identity plus payment for care |
A channel map for a two-location med spa
| Channel | Who | What goes there |
|---|---|---|
| #front-desk-north and #front-desk-south | Coordinators at that site, operations manager, owner as Viewer | Arrivals, consults booked, deposits, cancellations, retail |
| #injectors | Injectors, aestheticians, medical director, operations manager | Treatment questions between clinicians, product and technique notes, room status |
| #medical-director | Injectors and the medical director (private) | Sign-off questions, protocol clarifications, anything the director must see |
| #inventory | Injectors, operations manager | Counts, orders, lot tracking, expirations |
| #schedule-changes | Everyone | Who is at which site, swaps, late openings |
| #owners | Owner and operations manager (private) | Revenue, hiring, leases, marketing budget |
| #marketing | Owner, marketing person, operations manager | Promotions and content planning; no client photos without the consent form on file |
Note what is missing: there is no channel where a client photo goes to the marketing person by default. That is deliberate.
Before-and-after photos: the one rule that saves you
A tool with a team files library and 20 GB per location makes this workable: the photo is uploaded once, previewed in the thread, and searchable later. Retention controls decide how long chat copies live. The chart remains the record, and the audit viewer keeps an exportable record of workspace activity, which matters the day a client asks how her photo was handled.
Daily situations, handled in channels
- A coordinator finishes a consult booking and posts in #front-desk-north: "Consult 3:00, lip filler, first visit, medical history form done." The injector sees it before the client arrives. The name is in the booking system.
- An injector has a sign-off question. She posts a photo and a one-line summary in #medical-director. The director answers from his other office in a thread, and the decision is documented in the chart afterward.
- The south location is down to its last box of a product. The injector posts in #inventory; the operations manager orders and replies with the delivery date. Nobody texts the owner at 9 pm.
- A client calls after hours about swelling. The injector on call reaches the medical director in a direct message, follows the protocol, and the follow-up is charted in the morning.
- The owner wants to know how the new membership is selling. She reads #front-desk-south as a Viewer and asks the question in #owners, not in the channel where a client's name just appeared.
Owners who are not clinicians
Many med spa owners are business people, not nurses or physicians. They need operational information constantly and clinical detail almost never. Channel roles handle this well: the owner is a Viewer in the front-desk channels, a Member in #owners and #marketing, and not in #medical-director at all. Sharing the minimum necessary is a HIPAA principle, and it is also just good manners toward clients who did not come in to be discussed with the business side.
The same thinking applies to a marketing contractor or a social media freelancer: a seat in #marketing, nothing clinical, and removal from the workspace the day the contract ends. Invite-only membership by exact email makes that clean.
Cost for two locations
On Yodl, each location is $10 a month and includes 5 users and 20 GB. Two sites with nine staff is $20 a month; add a tenth and eleventh person for $2 each. The BAA is signed on every plan, passkeys and a 15-minute inactivity lock are standard, and push notifications never show message content, which matters when phones are face up on a treatment room counter. Yodl is $10 a month for 5 people with a signed BAA; the numbers are on the pricing page.
Photos in the chart, questions in a private clinical channel, owners as Viewers, marketing only with written consent, and a tool that signs the BAA. Two locations on Yodl cost $20 a month.
Frequently asked questions
Is a med spa a covered entity under HIPAA?
A med spa that provides medical treatments and keeps charts should assume so, and any that bills insurance certainly is. Cash-only spas outside the strict definition still face state privacy laws, so the practical answer is to act as if HIPAA applies.
Can we share before-and-after photos in team chat?
Inside a tool that signed a BAA, yes, for clinical purposes and only with the people who need to see them. Never in WhatsApp or iMessage, and never for marketing without the client's written consent.
Does the medical director need to be in the chat?
It helps. A private #medical-director channel gives injectors one place for sign-off and protocol questions, and gives the director one place to look. Decisions still get documented in the chart.
What about WhatsApp, since it is encrypted?
Encryption protects the message in transit. WhatsApp does not sign a BAA, Meta's terms say it is not a business associate, and there is no way to remove a former injector's copy of every photo. It is not an appropriate tool for client information.
Should the social media person be in the workspace?
Only in #marketing, with no access to clinical channels, and removed on the day the engagement ends. Photos reach that channel only after the consent form is on file.