Opening a med spa looks, from the outside, like opening a nice salon with better equipment. It isn’t. The moment your service menu includes neurotoxin, filler, or anything else that meets the definition of a medical procedure, you’ve opened a healthcare business, and most of what’s hard about the first year comes from that side, not from the aesthetics side.
Everything below is written for Ontario. Some of it travels to other provinces, but the regulatory details don’t, and even the Ontario ones should be confirmed with the relevant college or a lawyer before you rely on them. Rules in this space keep changing, and med spas have been getting more regulatory attention lately, not less.
Who is allowed to inject
In Ontario, administering a substance by injection is a controlled act under the Regulated Health Professions Act. That means it can only be performed by a health professional whose college authorizes it, or by someone acting under a proper delegation from an authorized prescriber.
In practice, most med spas are built around one of these arrangements:
- A physician or nurse practitioner owns or directs the practice and performs or delegates the injections.
- Registered nurses inject under a medical directive or direct order from a physician or NP.
Botulinum toxin is a prescription drug. Someone with prescribing authority has to assess the patient and authorize the treatment, and that assessment has to be real, not a signature on a stack of charts once a month. The College of Physicians and Surgeons of Ontario has published expectations around delegation, and “the doctor has never met the patient” is exactly the pattern those expectations exist to stop.
If you’re an aesthetician planning to open a med spa, this is the first structural decision you’ll make: who your medical director or prescriber is, what their actual involvement looks like, and how that involvement is documented. Get this wrong and nothing else on this list matters.
The paperwork that has to exist before day one
Consent forms, per procedure. General “I consent to treatment” intake doesn’t cover a filler appointment. You need procedure-specific consent that names the product and its risks, plus separate photo consent, with clinical use and marketing use consented separately. We’ve written a full breakdown of med spa consent and photo documentation if you want the detail.
Business basics. Registration, a municipal business licence if your city wants one, and commercial insurance that actually covers what’s on your menu. Read the exclusions: standard salon insurance usually carves out injectables entirely. Your injectors also need their own professional liability coverage through their college or association, which is separate from anything the clinic carries.
HST registration. Cosmetic procedures are generally taxable. Medically necessary care is exempt, but Botox for frown lines isn’t medically necessary, so plan on charging and remitting HST for most of your menu. This is worth an hour with an accountant who has seen a med spa before.
A privacy setup. Treatment records at a med spa are health records. In Ontario that puts you under PHIPA as a health information custodian, which has teeth: you need to know where records are stored, who can access them, and what you’d do about a breach. “The photos are on the clinic iPad” is not a privacy setup.
Records: the part everyone underestimates
Every treatment needs a chart entry. For injectables that means the product, the lot number, the expiry, the units and where they went, who injected, and the assessment behind the order. If a manufacturer recalls a lot, you need to be able to list every patient who received product from it. If a patient has a complication, the chart is what protects the injector.
Paper can technically do all of this. Paper also gets skipped on busy days, and a chart that gets skipped on busy days isn’t a record system, it’s a good intention. This is the strongest argument for getting software in place before you open rather than six months after: retrofitting records is miserable, and the habits your team builds in week one are the habits you’ll have in year three.
We’ve covered what injectable lot tracking should look like and what a defensible injectable chart contains in separate posts.
The software you need on day one
Keep the list short. You need four things working before your first client, and most of the rest can wait.
Booking with deposits and reminders. Cosmetic consultations no-show at higher rates than medical appointments, and a new med spa can’t absorb empty injector hours. You want online self-booking, automated reminders, and ideally deposit support from the start. The reasoning is covered in our post on reducing no-shows for cosmetic consultations.
Charting with photo support. In aesthetics, before-and-after photos are clinical documentation, and they belong in the chart, encrypted. Not in a camera roll.
Digital consent forms. Patients sign on their own device before the appointment and the signed copy files itself against their record.
Inventory with lot and expiry tracking. From the first vial you buy, not from whenever the spreadsheet becomes unmanageable.
Zdrovia covers all four in one platform, and the core features are free, which matters when you’re watching pre-revenue cash flow. But whatever you choose, choose it before you open. The clinics that struggle with software are almost always the ones that started with paper “temporarily.”
What can wait
Membership programs, loyalty points, marketing automation, a retail webstore: all real revenue tools, none of them day-one requirements. Every one of them is easier to add once your clinical records, booking, and consent flow are stable. A med spa that opens with airtight records and a manual loyalty program is in far better shape than one with a beautiful app and charts on paper.
The one-page version
Before your first client, you should be able to answer yes to all of these:
- We know who our prescriber/medical director is, and the delegation is documented.
- Every procedure on the menu has its own consent form, and photo consent is separate.
- Our insurance covers the procedures we offer, and our injectors carry their own coverage.
- We’re registered for HST and know which services are taxable.
- Every treatment will produce a chart entry with product, lot, units, sites, and injector.
- Photos, forms, and records are stored somewhere encrypted and access-controlled, and we could answer a PHIPA question about them.
- Booking, reminders, consent, charting, and inventory are set up and tested.
If any of those is a no, it’s cheaper to fix now than after opening. And if you want to see how the software half of the list looks in one system, the med spa solution page walks through it, or you can book a walkthrough and poke at it directly.