How med spas get more Google reviews without breaking Google's rules

The rules, in plain words

Google's policy for reviews on Maps is short and strict. A business may ask customers to review a genuine experience. It may not:

• Offer an incentive for a review, or for changing or removing one. Google names payment, discounts and free goods or services.
• Discourage negative reviews or ask only happy customers. This is called review gating.
• Pressure people to review while they're still on the premises, or ask them to include specific content, such as a staff member's name.

In the US, the Federal Trade Commission's final rule on fake reviews, announced August 14, 2024, also bans offering compensation or incentives conditioned on a review saying something positive or negative.

For a med spa, that rules out a lot of familiar tactics:

1. Ask every patient, not just the happy ones

Gating feels safe. It isn't, and not only because it breaks the rules. A rating built from everyone who came in reads as real. Google's own help page makes the same point: "A mix of positive and negative feedback often feels more trustworthy."

The bigger reason is simple arithmetic. Most patients who had a good visit would leave a review. Almost nobody asks them. A clinic that asks everyone, every time, will out-collect a clinic that asks the handful it feels sure about.

2. Time it after the visit, not at checkout

The best moment is a few hours after the appointment, the same day. The patient is home, the visit is fresh, and nobody is standing over her at the front desk.

• Same day, a few hours later. Late enough to feel unhurried, early enough to remember.
• One reminder after about five days, only if she hasn't left one. Then stop.
• Never ask no-shows. A review has to reflect a real visit.

One med spa nuance: ask about the visit, not the result. Injectable results take days to settle, but the experience (how easy it was to book, how the injector explained things, how the clinic felt) is fresh the same afternoon. That's what you're asking her to share.

3. Make it one tap, from your number

Google Business Profile lets you create a link or QR code that opens your review form directly. Put that link in a short, personal text from your clinic's own number, with her first name. No login screens, no searching for your clinic.

4. Reply to every review, without patient details

Google recommends replying to reviews, and future patients read your replies as closely as the reviews. For a med spa, replies are also where privacy goes wrong.

In October 2019, the US Department of Health and Human Services announced that a dental practice had paid $10,000 to settle potential HIPAA violations after it disclosed patient information while responding to reviews on Yelp. A reply that confirms someone is your patient, names a treatment or mentions a visit can do the same thing.

The safe pattern: thank them, don't confirm they're a patient, don't mention treatments or dates, and take anything specific offline.

Example replies. Names are made up. This isn't legal advice; check your own obligations with your compliance advisor.

What happened when one studio asked everyone

Nothing clever happened there. The studio already had happy clients. The difference was that every one of them got asked, at the right moment, in one tap.

A checklist you can use this week

1. Create your review link in Google Business Profile.
2. Write one short, personal request text. No reward, no star request, no names to mention.
3. Send it to every patient who came in, a few hours after the visit.
4. Send one reminder after about five days. Then stop.
5. Never ask no-shows, staff or family.
6. Reply to every review, without confirming anyone is a patient.
7. Take down any "review us for a discount" signs, cards or offers.

Or let Bella do it

Bella sends the request after every completed visit from your own number, sends the one reminder, and stops. New reviews get thoughtful replies, and you see your review count and rating in the owner dashboard. No patient is ever offered anything in return, and nobody is filtered out.