AI Receptionist for Salons and Med Spas: Booking-Heavy Call Flow, Deposit Policies, and Privacy Questions

Salon and med spa phones ring while stylists and providers are with clients. Missed calls become empty chairs; after-hours callers often book with whoever answers first. An AI receptionist for salons and med spas (an AI voice agent on your phone line) can take booking, reschedule, and FAQ calls without pulling a chair or treatment room offline.

This guide covers what a booking-heavy agent should and should not do, a sample call flow and prompt, deposit and cancellation wording, HighLevel Voice AI setup and costs, and the privacy questions med spas should ask vendors. It draws on HighLevel docs, HHS guidance, Digital Media Law Project recording notes, and Zenoti's published 2025 platform benchmarks (checked October 5, 2026). It is not legal or medical advice. We do not claim any setup described here is HIPAA compliant. Your practice, your compliance advisor, and your vendor contracts decide that.

Why do salons and med spas need an AI receptionist?

Because the business is appointment inventory. Every unanswered overflow or after-hours call is a slot that could have been filled, waitlisted, or recovered with a same-day reschedule — and front-desk staff cannot answer every ring while checking someone in.

Zenoti's 2025 Beauty & Wellness Benchmark Report (U.S. and Canada businesses on its platform, 2024 performance) gives useful context without inventing Peace Call statistics:

• Online booking demand is high; adoption varies. Zenoti reports that 80% of salon and spa guests and 97% of medical spa clients want to book via mobile, while the average med spa on its platform still books only 11% of appointments online (top earners 31%).
• Cancellations and no-shows still cost chairs. On the same platform benchmarks, salons show an 8% cancellation rate and 3% no-show rate; med spas show 16% cancellations and 5% no-shows — the highest no-show rate among the categories Zenoti lists.
• Rebooking and utilization reward systems. Top-earning salons on the platform rebook 30% of clients within 24 hours (average 10%) and run higher staff utilization than the category average.

Those figures are platform benchmarks, not universal industry averages. Your rates will differ. The operational takeaway still holds: phones, reminders, deposits, and waitlists protect booked time — and an AI receptionist is one way to keep the phone covered when the desk is full.

For platform cost context later, see the GoHighLevel Voice AI review and the AI Employee Growth vs Unlimited break-even guide.

Can a salon or med spa use an AI receptionist?

Yes, when it works as a scheduling and routing assistant — not a stylist, injector, or clinician. Scope it tightly: book and reschedule from approved calendars, answer approved FAQs, explain deposit and cancellation rules that are already on your site, and escalate anything medical or judgment-heavy to a human.

Reasonable jobs for it:

• Answer overflow, lunch, and after-hours calls so the front desk can stay with the guest in front of them.
• Sort callers into new guests, existing clients, and (for med spas) consult vs treatment vs billing.
• Book, reschedule, or cancel against HighLevel calendars (or take a request for staff to confirm in your salon software).
• Explain deposit, card-on-file, and late-cancel policies using only wording you approve.
• Offer a waitlist or next-available slot when the preferred stylist or provider is full.
• Answer approved FAQs: hours, parking, service menu names (not improvised prices), gift cards, memberships, prep instructions you publish, languages spoken.
• Send a short confirmation text with time, location, and policy link — no clinical details for med spa treatments.
• Escalate allergic reactions in progress, adverse post-treatment symptoms your medical director flags as urgent, or any caller who needs a clinician.

What should a salon or med spa AI receptionist never do?

It should never diagnose, recommend treatments or injectables, promise results, or invent prices. Write those limits into the prompt in plain words.

• No clinical or aesthetic advice. "You should get filler" or "that sounds like an infection" is out of scope. Collect a short reason category and book a consult, or transfer.
• No outcome promises. No "you'll look X years younger," no guaranteed Botox units, no "your rash is fine." Marketing claims belong on approved pages reviewed by your medical director — not in improvisation.
• No improvised pricing. Quote only menu prices or package fees listed in the knowledge base. Everything else: "A team member will confirm pricing when they review your request."
• No collecting full medical histories on the phone when a secure form or in-person intake is the policy. Ask only what booking needs (see the collect vs leave-out table below).
• No pretending to be human, and no guessing. HighLevel's setup guide says to tell the agent not to guess when information is missing (HighLevel docs).
• No card numbers spoken into the call unless your payment flow and vendor agreements explicitly support that channel. Prefer a secure link or front-desk handling.

How should privacy differ for a med spa vs a hair salon?

A haircut booking usually needs name, phone, service, and stylist preference. A med spa consult for injectables, lasers, or medical weight-loss often involves health details that may be protected health information (PHI) if the practice is a HIPAA covered entity. Whether your specific med spa is a covered entity, and what that requires, is a legal determination for your counsel — Peace Call does not decide that for you.

From HHS's primary guidance (the same anchors we use in the dental office guide):

• PHI includes identifiable information, including demographic data, that relates to a person's health or the health care they receive (HHS Privacy Rule summary).
• AI vendors can be business associates. One of HHS's own examples is a "third-party vendor Artificial Intelligence (AI) chatbot on a provider's patient portal" that handles PHI for tasks including "appointment scheduling." A phone agent is not a portal chatbot, but the logic is relevant when a vendor creates, receives, maintains, or transmits PHI for you.
• Storage alone can count. A cloud provider that stores ePHI is a business associate even if the data is encrypted and it has no key, and using one without a BAA violates the HIPAA Rules (HHS cloud guidance).
• Collect the minimum under the minimum necessary standard. A lean booking script lowers exposure; it does not replace a BAA when one is required.

The American Med Spa Association's HIPAA FAQs for medical spas summarize practice-facing topics (Notice of Privacy Practices, authorizations for marketing uses, risk assessment). Treat it as industry orientation, then confirm obligations with your advisor.

What does HighLevel offer for HIPAA?

Not by default. HighLevel sells a $297/month HIPAA add-on that includes a BAA. Per its HIPAA Compliance article, the add-on is account-wide, available on any plan, and can't be canceled, refunded, or downgraded. Each sub-account then needs its own HIPAA toggle, which can't be turned off. Listed data types include contacts, notes, custom fields, SMS/MMS, voice recordings, email, forms, and calendars, and the agency must provide its own BAA to the practice.

HighLevel's platform updates page adds that the BAA may expire if the HIPAA subscription lapses, and that Retell AI, Synthflow, and Botpress were added as AI subprocessors that power features such as voice AI. We could not find a specific mention of Voice AI transcripts, AI call summaries, or external language models in HighLevel's HIPAA article, so treat those as open questions.

Questions to get answered in writing before med spa go-live

1. Is our practice a HIPAA covered entity for the services this agent will touch, and do we need a BAA with this vendor?
2. Does the BAA (if any) cover Voice AI recordings, transcripts, and AI-generated summaries?
3. Which voice and language-model options are covered, and which subprocessors handle call audio?
4. Does anything change or stop working once a sub-account is in HIPAA mode?
5. How long is call data kept, and can we set deletion rules?
6. If an agency builds the agent, has it signed its own BAA with the practice?
7. Are confirmation texts and AI summaries stripped of treatment details (service category only)?
8. Who reviews transcripts before the agent takes live patient calls?

If you cannot get clear answers, keep AI off lines that handle patient health details, use a vendor whose BAA covers the exact features you will use, or limit the agent to non-PHI salon booking only.

What call flow works for a booking-heavy salon or med spa?

A short, predictable flow with policy and privacy notices near the start:

1. Greeting, AI disclosure, recording notice. "Thanks for calling [Studio]. I'm the virtual assistant, and this call may be recorded. Are you looking to book, reschedule, or something else?"
2. New vs existing, then preferred stylist, provider, or service category.
3. Name and callback number, read back to confirm.
4. Service and timing. For med spas: consult vs treatment vs follow-up — category only, not a symptom interview.
5. Policy line when your rules require it: deposit, card-on-file, or late-cancel window, using approved wording.
6. Book or take the request for staff to confirm in your booking system.
7. Recap and close, with a text that has time, address, and a policy link — no clinical details.

Some states require every party's consent to record a call. The Digital Media Law Project explains one-party vs all-party consent rules and recommends getting consent when any party may be in an all-party state. Keep the recording notice in the greeting.

What information should the AI collect, and what should it leave out?

Collect only what the next booking step needs. Leave health histories and payment cards for secure channels.

In HighLevel you can choose whether AI call summaries are copied into contact notes (docs), and you can auto-delete older call recordings (phone pricing guide).

How should deposits and no-show policies sound on the phone?

The agent should read your published policy, not invent one. Put the exact sentences in the knowledge base.

Example patterns (replace with your real rules):

• Deposit: "New guests place a [$X / X%] deposit to hold the appointment. I can text you the secure link after we pick a time."
• Late cancel: "We ask for [N] hours' notice to cancel or reschedule. Late cancels may be charged [fee] per our policy."
• No-show: "Missed appointments without notice may be charged [fee] / may forfeit the deposit."
• Card on file: "We keep a card on file for no-show protection. The front desk will confirm that when you arrive or via the booking link."

Do not threaten fees that are not in your written policy. Do not debate the policy on the call — offer to have a manager follow up.

Zenoti's platform benchmarks associate lower no-shows with reminders and prepaid deposits; that is a vendor report, not a Peace Call guarantee that any specific fee structure will cut your rate by a fixed percent.

What does a salon / med spa AI receptionist prompt look like?

Here's a condensed version. Adapt the medical-urgency block only if your medical director approves it. Fuller templates live in the free Prompt Pack.

ROLE: You are the virtual booking assistant for [Studio], a [salon /
med spa] in [City]. Greet: "Thanks for calling [Studio]. I'm the
virtual assistant, and this call may be recorded."

GOAL: Learn if the caller is new or existing, take name and callback
number, and book or request an appointment. Explain deposit and
cancellation rules only from the knowledge base.

URGENT (med spa only, if approved): If the caller reports trouble
breathing, swelling of the face/throat, or a possible allergic
reaction happening now, say: "[approved 911/ER line]". Stop booking.
Then run the On-Call Alert action.

RULES:
- Never diagnose, recommend treatments, or promise results.
- Never ask for full medical history, medication lists, or card
  numbers on this call.
- Only answer from the knowledge base. If unsure, take a message.
- Quote only prices listed in the knowledge base.
- One question at a time. Read phone numbers back to confirm.
- Do not pretend to be human.

CLOSE: Recap date, time, and service category. Say a text
confirmation is coming. Do not include clinical details in the text.

How do you set up a salon or med spa AI receptionist in HighLevel?

Create a Voice AI agent in the location's sub-account, connect a knowledge base and calendars, add transfer and SMS actions, and deploy as backup or after-hours — after the privacy decision is settled for med spas. Per HighLevel's docs (October 2026):

1. Privacy first (med spas). If patient health information will reach the agent, settle BAA coverage, buy the HIPAA add-on if appropriate, enable HIPAA on the sub-account, and get written answers to the questions above. Pure beauty salons without PHI may not need that path — confirm with your advisor.
2. Create the agent under AI Agents → Voice AI (Marketplace, Custom Agent, or Flow Based Builder).
3. Core settings: name, voice, model, language, time zone, greeting, prompt.
4. Knowledge base with hours, menu names, deposit/cancel policy text, parking, gift cards, memberships, and prep links you allow (docs).
5. Actions. Appointment Booking across stylist or provider calendars (docs). Add Call Transfer to front desk or on-call, Send SMS for confirmations and deposit links, and Trigger a Workflow for waitlist or manager alerts.
6. Deploy with Use as Backup or Answer Calls Directly, plus custom Working Hours. AI working hours and calendar availability are separate settings — check both.

Voice AI books on HighLevel calendars. If your schedule lives in Zenoti, Boulevard, Vagaro, Mindbody, or another salon platform, confirm an integration exists. If it does not, have the agent take requests that staff confirm in the morning.

How much does a salon or med spa AI receptionist cost in HighLevel?

As of October 5, 2026, a single location on HighLevel's Starter plan without HIPAA would pay roughly $110–$200 a month at modest volumes before language-model tokens, texts, and taxes. A med spa that also buys the $297/month HIPAA add-on lands closer to the $410–$500 range illustrated in our dental guide. Figures come from HighLevel's pricing page, AI Product Pricing, and Phone System Pricing Guide:

Minute counts are illustrations, not usage data. A premium voice or speech-to-speech model raises the AI line. Recording, texts, and A2P registration are extra. The HIPAA add-on is per agency account. HighLevel warns that prices change, so confirm in-app before quoting. Plan math: Growth vs Unlimited.

What are the alternatives to building it yourself?

• A human answering service with beauty or healthcare options. Ask about BAAs before any patient line.
• A salon-platform chatbot or AI receptionist built into your booking software. Compare calendar sync and transcript retention.
• Voicemail plus missed call text back, with texts kept free of treatment details.

Compare costs in AI receptionist vs. answering service vs. voicemail, or read our HighLevel Voice AI review.

How should you test it before guests or patients call?

Test by real phone call — HighLevel's browser Web Call test does not run transfers (docs):

• New guest booking a haircut; existing client rescheduling color
• Preferred stylist full → waitlist or alternate offered
• Deposit / late-cancel question (confirm approved wording only)
• Med spa: "I want lip filler tomorrow" (book consult or approved treatment slot; no advice)
• Med spa: possible allergic reaction happening now (emergency line; stop booking)
• "How many units of Botox do I need?" and "Will this remove my wrinkles?" (must refuse)
• Caller overshares health details (check what lands in summaries and notes)
• Confirmation SMS has no clinical details

Read every transcript before go-live. Related testing ideas: dental AI receptionist guide and HVAC after-hours script.

FAQ

Is an AI receptionist HIPAA compliant for med spas? No tool is compliant on its own. Compliance depends on whether you are a covered entity, your BAA, configuration, and policies. HighLevel is not HIPAA compliant by default and sells a $297/month add-on that includes a BAA. Ask in writing whether Voice AI audio, transcripts, and summaries are covered.

Do hair salons need a BAA for an AI phone agent? Often a pure beauty booking flow does not involve PHI the way a medical treatment consult can. That is still a fact-specific question for your advisor — do not assume from this article.

Can the AI book into Zenoti, Boulevard, or Vagaro? HighLevel Voice AI books into HighLevel calendars. Sync with your salon platform depends on available integrations. If none exist, take requests and let staff confirm in the native system.

Should the agent tell callers it's an AI? We recommend it. Saying "I'm the virtual assistant" up front, along with a recording notice, sets expectations.

Can we mention prices on the call? Only prices you put in the knowledge base. Everything else goes to staff.

Will Voice AI replace my front desk? No. It covers overflow and after-hours booking so the desk can stay with the guest in the chair. Complex consultations, check-in, and retail still need people.

Where do I get a fuller prompt? The free Peace Call Prompt Pack includes voice AI receptionist prompts and knowledge-base templates you can adapt for salon and med spa booking alongside this guide.

Sources (checked October 5, 2026)