The 9-Step Framework for Deploying Agentic AI in a Med Spa

Here is the part nobody says to the founder of a med spa out loud. Somewhere between the first treatment room and a full book, you stopped being the practitioner and became the operating system.

Every consultation to follow up on, every consent form to file, every course that finished and needs a rebook, every membership quietly coming up for renewal, every "did we ever charge for that top-up", all of it waits on your attention. Which means the whole clinic runs exactly as fast as one busy owner can look up from a treatment and remember.

This is the framework we use to take that job off the owner and give it to a system, without the risk that comes with letting software anywhere near consent, medical history and a client's face. It is nine steps in three phases.

Four before you build anything, three to build it, and two to do the thing the whole exercise is for, which is to remove yourself from the middle of every treatment journey.

It is worth saying plainly what this is not. It is not a new booking system, and it is emphatically not "let AI do the treatments".

The clinical judgement, who is a candidate, what is safe, what to inject and where, stays entirely with your qualified practitioners and never moves. What changes is that the filing, the chasing, the rebooking, the aftercare reminders and the invoicing stop landing on one person between clients, so the follow-up never slips because the owner was gowned up in a treatment room the afternoon it mattered.

You quietly became the operating system

It happens slowly. In the early years you did the consults, the treatments, the reminders and the rebooking yourself because there was nobody else, and you were good with clients, so the clinic grew.

Then it kept growing and the routing never left your head, because it was faster to just do it than to write it down. Now you are the one who notices a client is three sessions into a six-session laser course and has not been back in over a week.

You are the one who remembers that a membership renews on the fifteenth. You are the one who spots, weeks later, that an injectables top-up was delivered and never actually charged.

None of that is written down anywhere. It lives in your attention, and in a clinic attention is the scarcest thing there is, because most of your day is spent with your hands full and your eyes on a client, not on a screen.

Three things follow from that, and every one of them costs the clinic real money and real clients.

• The clinic runs at the owner's attention speed. An owner spending the gaps between clients chasing forms, texting rebook reminders and checking who is due back is normal. That is not treatment work and it is not growth work. It is triage, done by the one person the clients came to see.
• Rebooks happen because somebody remembered. Which is fine until the fortnight nobody did. A client who finished a course and drifted away is not a small miss. It is the most likely-to-return, highest-value person you had, walking to whoever texts them first.
• Nothing survives you being off the floor. A clinic where the owner is the router does not keep following up when that owner is on holiday or simply booked solid for a week. Courses lapse, memberships renew unnoticed, aftercare checks go unmade, and you find out when the client does not come back.

The instinct is to fix this by hiring another receptionist or a clinic manager. That works, and it also adds a salary, more supervision, and one more person who has to learn all the unwritten rules you were already the only keeper of.

You have not removed the bottleneck, you have given it a second head to depend on, and the day that person is off sick the follow-ups stop again. The alternative is to write the routing down and let a system run the parts that never needed a qualified practitioner in the first place.

That is what the next nine steps do.

For a med spa, the client experience is the marketing

One belief before the framework, because it decides how you read the rest of it. In an aesthetics clinic, the client experience is the marketing.

Not the Instagram grid, not the logo on the frontage. It is the reminder that arrived before the client had to think about it, the aftercare check that landed the evening of a treatment and made them feel looked after, the rebook offered at exactly the right point in a course.

That is what gets a clinic referred to a friend and reviewed with five stars, and it is produced almost entirely by the nine jobs we are about to automate.

This is why it belongs on a growth marketing site rather than in a software catalogue. A client who finished a course and was never rebooked is not an admin slip, it is a lapsed regular you already paid to acquire, walking away.

A membership that lapsed because nobody nudged the renewal is not a diary oversight, it is recurring revenue you earned and then let go. An aftercare check that never happened is not a small courtesy missed, it is the exact moment a nervous client decides whether they trust you enough to come back and to tell a friend.

When the operating system is one busy owner, the client experience frays in precisely the places a client feels most, and a slicker clinic two streets away is ready to make them feel looked after instead.

Which brings up the trap most growing clinics fall into. They try to grow by pouring more money into ads and more new faces through the door, into a clinic whose follow-up, rebooking and aftercare still run through the owner's memory.

That does not produce profit. It produces a leaky bucket, a full appointment book of first-timers who never come back for a second treatment, because nobody had the capacity to look after them properly.

This is the capacity problem, and it is one of exactly three things almost every stuck clinic is stuck on. The other two are getting the right clients in and converting a consult into a course, and I have written the full diagnostic in the 3A Machine.

So the goal of deploying agentic AI in a clinic is not "use AI to do treatments". It is to build the capacity that lets you grow the book without the aftercare and the rebooking falling over.

Get the nine steps running and the same practitioners and the same reception hold two or three times the active client base, with every course rebooked on time, every membership renewed, and every client feeling more looked after, not less. Fix capacity first, then go and win the clients, because only then will winning them actually pay.

The nine steps, in three phases

Here is the whole map on one page. Your clinic already runs all nine of these jobs today, whether or not anyone has ever named them.

The framework does not add work. It names the jobs, then decides one at a time whether a person does each one or a system does it.

Notice the shape. Four steps happen before anybody builds anything, and skipping them is the single most common reason a clinic's "let us try some AI" project quietly dies.

People buy the clever part first, point it at nothing in particular, and end up with a fast tool that does not know how the clinic actually runs, what a valid consent looks like, when a course should be rebooked, which client never gets a treatment without a review. The order below is designed to stop that.

Step 1. Diagnose: find what is actually bleeding

You cannot fix what you have not counted, and most clinics have never counted this. So the first step is a leak audit, and its only job is to put a number on the money and the clients already walking out of the door.

Not a survey of how everyone feels about the software. A count of losses.

In an aesthetics clinic the leaks are always in the same few places. Clients who finished a treatment course and were never rebooked, which is the biggest and quietest one, because a person three sessions into six who drifts away costs you the rest of the course and the renewal after it.

Memberships that lapsed because the renewal came up on a day the owner was busy and nobody nudged it. Packages sold with sessions still unused, ticking toward an expiry nobody is watching, which is money you were paid for and are about to have to either honour late or awkwardly explain.

And treatments and consults delivered and never billed, the injectables top-up, the extra laser session squeezed in as a favour, the consult that turned into advice and never made it onto a bill.

Then the loudest hours, if not the largest number: the time reception and the owner burn chasing unsigned forms, texting rebook reminders one at a time, and hunting for a consent form while a client waits. Add it all up honestly and the total is almost always bigger than expected, and concentrated in two or three places rather than spread evenly.

That concentration is the gift. It tells you exactly where to point the build first, and it becomes the before number you use, at the very end, to prove the system paid for itself.

Step 2. Shadow: follow one client from consult to rebook

Now you watch. Pick one real client journey, ideally a course-based treatment like laser or a skin programme, and follow it end to end, from the first enquiry, through the consultation, the consent and pre-treatment checks, the treatment itself, the aftercare, and on to the rebook and the review.

Write down every single thing that happens and every decision anybody makes. Not the tidy version in the induction folder nobody opens.

The real one.

This is where you discover the clinic does not run on the written process. It runs on a hundred unwritten rules that live in your practitioners' heads and, more than anywhere else, in the messages and the group chat.

Which forms have to be signed before a needle comes anywhere near a client. The contraindication you always check for this treatment.

The client you never treat without a patch test first. The exact point in a course when a rebook actually lands, not too eager, not too late.

How long after a treatment the aftercare check should go out for it to feel caring rather than automated. None of it is written down, all of it is load-bearing, and some of it is genuinely a safety matter.

The excavation is the real work of this step. You read back through the messages and the notes and pull out the rules the clinic actually operates on, the ones that were never a decision, just a habit that turned out to be right and safe.

That messy, lived-in reality is what you are about to encode. Skip it and you will automate the fantasy version of the clinic, ship it, and watch reception quietly go back to doing it their own way because the system does not know what they know.

And be honest about the fragility this surfaces: in most clinics the real operating manual, including some of the safety habits, is one long-serving practitioner's memory, and it walks out of the door the day they leave.

Step 3. SOP: write the unwritten procedure down

Everything you excavated now becomes writing. Three things, specifically, because a clinic needs more than a generic procedure.

A written procedure in plain language, step by step, in the order it really happens. A written pre-treatment and consent checklist, the hard list of what must be true before any treatment is booked or begun.

And a written follow-up schedule, when the aftercare check goes out, when the rebook is offered, when a membership renewal is raised. This is the least glamorous step in the framework and it is the one that makes an agentic system possible and safe, because a front-desk assistant can only work a procedure that has actually been written, and it can only enforce a safety gate that actually exists on paper.

The consent and pre-treatment checklist is the heart of it, and for a clinic it is not paperwork, it is the line that keeps the whole thing safe. For an injectables appointment it looks like a hard list: a consultation done, the medical history taken, signed consent on file, an allergy and contraindication check completed, before photos captured, and the aftercare briefing given.

Written as a checklist, the messy reality becomes a gate a machine can enforce perfectly, every time, so no appointment ever advances to booked while a required item is missing, without a busy owner waving something through on a full day. The follow-up schedule does the same for care: the aftercare check at the right interval, the rebook offered at the right session, the membership renewal raised before it lapses, each one a written rule rather than a thing somebody has to remember between clients.

Write it for a sensible new practitioner on their first day, not for a machine. If a person could follow it without asking a single question, a system can run it.

If it still needs somebody to "just know" when a rebook should go out or what has to be on file before a treatment, the procedure is not finished, and you are not ready to build. And to be completely clear about the boundary: none of this writes the clinical decision.

What is safe, what is suitable, what to treat and how, stays with the practitioner. The written procedure captures the admin around that decision and the safety gate in front of it, so the practitioner's judgement is protected, never replaced.

Step 4. Baseline: agree the numbers before you touch anything

The last step before the build, and it is thirty minutes that saves you a year of arguments. Write down the current numbers and get the owner and the lead practitioner to agree them.

How long it takes to file a signed form to the right client record today. What share of finished courses actually get rebooked.

How many memberships lapse in a typical month without anyone nudging the renewal. How much treatment sits delivered but unbilled right now, and how many package sessions are unused and about to expire.

How fast the first reply to a new enquiry goes out. Real numbers, honestly rounded, on the record.

You do this for one reason. In three months, when the system is running, memory rewrites history.

People forget how bad it was, decide it was "always basically fine", and start to wonder what they are paying for. The baseline is the receipt.

It is what lets the weekly proof report at the end say "filing a signed form to the right client went from about twenty minutes by hand to about two" and have that land as a fact everyone agreed up front, rather than a vendor's claim.

It is also the moment to decide what "better" means for this clinic, so the build aims at a number and not a vibe. A clinic bleeding on lapsed courses and dead memberships is not chasing the same win as one drowning in unbilled top-ups or one losing its evenings to form-chasing.

Name the number now. It is what everything you build next is pointed at.

Step 5. The command center: the whole clinic on one screen

Now you build, and the first thing you build is the place the owner looks. One screen that shows the whole clinic at a glance, in the order that costs money, so nobody reconstructs the state of the book from a diary, a chat thread, a card machine and a shoebox of forms every morning.

Build it on one spine, not twelve tools. This matters more than it sounds.

Every job in the audit is tempting to solve with its own separate app, a rebooking app, a forms app, a reviews app, a membership app, and a year later you have a dozen subscriptions that do not talk to each other and an owner who is now the integration layer between them. Build the whole thing on one foundation, one place the client records and the context live, and the next piece is nearly free because everything it needs already exists.

The centre of the screen is a client radar: every active client, ranked not alphabetically or by next appointment, but by who is about to quietly lapse. The laser course that is three of six and has not been back in nine days sits at the top, flagged as lapsing, whether or not anybody asked.

Around it, the numbers an owner actually needs: active clients needing a nudge today, finished courses not rebooked, treatment delivered but not billed, packages and memberships expiring this month.

Then the follow-up clocks. A clinic does not have one follow-up, it has dozens running at once across every client, and they are all different.

A shared diary flattens them into a comforting list of appointments that hides the one client about to slip away with no appointment at all. The command center pulls them apart and shows each on its own: the rebook window with the hours left to catch a finished course before it drops off, the membership renewal coming up, the aftercare check due on a recent treatment.

Three different windows on three different clients, each one a client quietly lost if it closes, and the dangerous one is the one you can now see.

Beside the clocks, the money on the floor: every treatment delivered, done, and never invoiced. The extra laser session.

The injectables top-up. The consult that became advice.

In most clinics this is a genuinely uncomfortable number the first time it appears on a screen, because the work was already done, the product already used, the room already occupied, and it simply never got billed. It was that raising the invoice was a small annoying job nobody owned in the rush between clients, which is a fair description of most of what leaks in a clinic.

And the document wall. An established clinic is sitting on an enormous pile of client records, consent forms, medical histories, before and after photos, treatment plans and aftercare notes, hundreds of thousands of files across folders nobody has fully mapped in years.

The command center reads that existing storage where it already lives, with no migration and no "please move every client record into our new system", and makes it navigable and countable, so any consent form or photo set is found in seconds instead of a frightened hunt through folders while a client waits in the chair. It also quietly surfaces the record that needs attention, the consent due a review, before it becomes a problem.

One design choice worth naming, because clinics always ask, and because medical records make it more than a preference. The command center is owner-locked, and the team gets read-only logins scoped to what they need.

The owner sees the money and the whole board. A therapist sees the clients and the forms for the treatments they deliver.

Nobody can quietly change a number or a record they should only be reading, and the owner never loses the single honest view of the clinic the whole build exists to give them.

Step 6. The procedure as data: the clinic's mind

The procedure and the checklist you wrote in step 3 are documents, and a document just sits there. In step 6 you turn them into data the system can reason over: every protocol, every consent rule, every contraindication check, every aftercare cadence, and every good answer the clinic has ever given, connected by meaning rather than filed in folders.

This is the clinic's mind, and it is what makes the front-desk assistant in the next step sound like your clinic instead of a generic model, and, more importantly, enforce your safety rules instead of inventing its own.

In practice it means anybody can ask a plain question and get the clinic's own answer, not the internet's. What is our pre-treatment checklist for injectables.

How long after a laser session should the aftercare check go out. What is our policy on patch testing before a first treatment.

When do we offer the rebook in a six-session course. The answer comes back grounded in the clinic's own written procedure, with the source it came from, so it is checkable rather than a confident guess, which is exactly what you need when the subject is a needle and a face.

The reason this matters more than it looks is drift, and in a clinic drift is not a quirk, it is a risk. A general model, asked the same safety question twice, will happily give two confident and slightly different answers, and when the question is about consent or a contraindication, that is not acceptable.

Grounding every answer in the clinic's own written procedure kills it. The system is reading your rules and quoting them with the source, and when a protocol changes you change it in one place and every answer changes with it.

It is also where the pre-treatment checklist becomes enforceable rather than advisory, because the refusal fence in the next step reads its gates from exactly here.

Step 7. The front-desk assistant: filing, rebooking and reminders that show up on time

Now the part people picture when they hear "AI". An employee, not a chatbot, and the distinction is the whole thing.

A chatbot waits to be asked. An employee wakes on a timer, reads the live clinic, does its round, files the forms, drafts the rebooks and the reminders, and flags what needs a human, whether or not anybody prompted it.

I have written the longer version in AI employees, not chatbots.

In a clinic it is a small crew of them, each with one job, all reading from the clinic's mind. A front-desk assistant that reads a photographed consent form or medical history, understands it, matches it to the right client record and files it, and starts the pre-treatment checklist.

A refusal fence that will not let a treatment be booked until consent and every required pre-treatment item are on the record. A rebooking and follow-up agent that spots the client who finished a course and has not been back, drafts a warm personal check-in, and lines up the aftercare and the membership renewal at the right time.

An invoice filler that drafts the bill for a delivered treatment straight from the record of the work. And a talking agent that answers a client's question, in their own language, without pulling a practitioner out of a treatment.

There is a quieter agent in this crew that owners never ask for and always end up valuing most: a critic. Before any piece of work reaches a human, a second agent grades it against the procedure.

Is this form matched to the right client, is the checklist actually complete, is this the right client to be offered a rebook and is the message warm rather than robotic. Anything that fails goes back to be redone before you ever see it.

This is the line between AI you can run and AI you can trust in a place where a mistake means an unsafe booking or a client who feels processed rather than cared for.

A front-desk assistant that can act is useful and it is also dangerous, so this step ships with four safety rules and they are not optional. They are the reason you can hand a system this much and sleep, and in a clinic the first one is not a convenience, it is a safety gate.

• No treatment is booked until consent and the pre-treatment checklist are complete. This is the refusal fence, and it is the most important line in the build. If consent is missing, or a required check is not on the record, the assistant declines to book and escalates to a human rather than improvising. The refusal is a feature, not a failure, and it is the one rule that keeps the automation safe.
• Every file operation stays inside set boundaries, and deletes go to a recycle bin. It cannot reach outside the client records and folders it was given, and nothing it removes, no form, no photo, no note, is ever truly gone. A wrong filing is always recoverable, which matters when the files are medical records.
• Every client-facing message waits for a human yes. It drafts the rebook, the aftercare check, the renewal nudge, the reply, the invoice, then stops. A person reads it and presses send. Anything that touches a client, their treatment, their money or the clinic's name gets a human on it first.
• Ambiguous details come back empty, never guessed. If it is not sure which client a form belongs to, whether a consent is current, or when something is due, it says so and asks. A blank is safe. A confident wrong answer about a client's consent or medical history is how a system does real damage in a clinic.

Step 8. Hand it to the team

The build is running. Now it stops being the owner's private tool and becomes how reception and the practitioners work, and the shift is subtle but total: people move from performing the admin to approving it.

The system does the first pass of everything, and a person says yes, tweaks a message, or sends it back. Same team, far more clients looked after, and your qualified people are left doing the consults, the treatments and the relationships that were always the actual job.

That handover is made of a few specific things. A daily follow-up drafter that writes the rebook and aftercare messages a client is owed, ready for a person to approve and send.

An activity wall so the owner can see what the system and the team did without asking anyone. A change watcher that notices when a client goes quiet after a treatment, or a membership is about to lapse, or a package is running down to its expiry with sessions unused.

And the piece everyone feels first: the morning brief.

At eight in the morning, before anyone opens anything, one message lands in order of what matters: here are the two clients about to lapse, including the laser course nine days without a rebook, here are the packages and memberships expiring this month with the reminders already drafted, here is the treatment waiting to be invoiced, here is the consult from two days ago that never got booked in. The team walks in already knowing the day instead of discovering it between clients.

A word on the human side, because it decides whether any of this sticks. The word removal frightens a team, and if reception thinks it means removing them, they will quietly starve the system of the knowledge it needs and go back to the diary.

It does not mean that. It means removing the form-chasing, the one-at-a-time reminder texts, the frightened hunts for a consent form, and leaving people with the clients, the consults and the care that were always the real work of a clinic.

Say it out loud, early and often. A team that believes the system is on their side will feed it.

A team that fears it will fight it, and win.

Step 9. Removal is the whole point

Here is the step everyone gets wrong, and it is the reason the framework exists. Step 9 is not training.

It is removal. The goal was never to teach the owner to use a clever new tool.

It was to take the operating-system job out of the owner's head, so the clinic stops running at the speed of one person's attention between treatments.

You know you have reached it by a specific test: the owner can take a genuine week off the floor and nothing leaks. Forms still get filed to the right record.

Finished courses still get rebooked, warmly and on time. Memberships still get renewed before they lapse.

Packages with unused sessions still get watched. Aftercare checks still go out and make clients feel looked after.

Treatments still get invoiced the same week. Nothing waits for one person to come back and remember, because that person is no longer the thing the routing runs through.

They approve the exceptions from their phone, or they do not, and it holds either way.

And this is where the baseline earns its keep. Every week a proof report goes to the owner and says, in the numbers they agreed at the start, what the system did.

Forms filed in minutes instead of at the end of a long day. Every finished course contacted for a rebook, so nobody lapsed unnoticed.

Zero packages expired with unused sessions while nobody was watching. Dozens of rebook and aftercare messages drafted with no front-desk time spent.

It is not a dashboard somebody has to go and check, it is the system reporting to the owner, unprompted, on whether it is still earning its keep.

And then the question that is really the point: what does the owner do with the attention they just got back. In every clinic the honest answer is the same, and it is why this belongs on a growth marketing site.

They go and do the work only the owner can do. The treatments only they are trusted for, the consults that convert, the second room, the next practitioner, the growth.

Removal is not the end of the owner's involvement. It is the first time the owner gets to actually be the owner of the clinic rather than its busiest and most expensive receptionist.

What it costs to run

This is the question every owner asks within about ninety seconds, and the honest answer surprises people in the right direction. It is far less than they expect, and far more transparent, because the running cost is metered and shown like a utility bill.

For a working system on a real clinic's volume, the AI usage runs on the order of a few dollars a day, and the hosting and database are a few tens of dollars a month, so the whole thing comes to roughly a hundred dollars a month to run. Your volume will differ, which is exactly why the meter is built in from day one and shown to the owner on day one.

No hidden meter, ever.

Now put that next to what it replaces, with round numbers you can redo with your own. Say the owner and reception lose two and a half hours a day to chasing forms, texting rebook reminders one at a time, hunting for records and preparing invoices by hand, across twenty two working days.

That is fifty five hours a month. Value that time at even a modest fifty dollars an hour, low for a clinic owner's time, and it is over two and a half thousand dollars a month of attention, against roughly a hundred to run the system that gives most of it back.

And that ignores the two biggest wins, because neither shows up as time saved: the finished courses that got rebooked instead of lapsing, and the memberships and treatments that finally got renewed and billed. Those show up as revenue that did not leave.

Where to start on Monday

Nobody builds all nine steps at once, and you should not try. This is a map, not a project plan, and the map is useful the moment you have it, because it tells you where you are and what the next single step is.

So do not start with the screen that impressed you most. Start with the step the audit said is bleeding worst.

If clients keep finishing a course and never coming back, the client radar by who is lapsing and the rebooking agent pay for the whole build in the first month. If treatments keep getting delivered and never billed, the money-on-the-floor wall and the invoice filler get you paid for work you already did.

If reception is drowning in forms and the phone, start with the front-desk assistant and the document wall. And if there is any question about consent or safety being missed on a busy day, build the refusal fence first, because that one is not about money.

The full logic for choosing the first thing is in what to automate first in a service business, and the honest way to measure whether it worked is in true ROI versus reported ROAS.

One thing at a time. Diagnose, build the one piece that hurts most, put a human gate on anything irreversible or unsafe, then the next piece, which will be cheaper than the first because it sits on the same spine.

That is the whole method. This same framework runs in an accounting firm, a shipping company, a law practice and a construction consultancy, the labels on the screens change and the nine jobs do not, and the full walk-through of the general version is in the 9-step framework for deploying agentic AI.

The clinics that end up with a real system instead of a browser full of half-used apps all started the same way: one step too small to fail, aimed at a number they had already agreed was bleeding.