THE TRIGGER
Why owners ask this now
Most med spa owners don't go looking for a vetting checklist before their first agency. They go looking for one after. The pattern shows up across owner communities with enough repetition to call it a trend: an owner signs a retainer, pays for months of "strategy," and ends up with a vague report and no new patients.
One owner who has worked with a couple hundred agencies put it plainly: "I've never met a MedSpa that was satisfied with their agency results." That's not one bad vendor — that's a pattern across an entire category of buyer.
The money at stake is real. One practice owner described clients convinced to spend $50K–$120K annually on digital marketing before working with someone more transparent. Another owner, one month from closing the business, asked for direct advice after trying what they called "everything."
A recurring thread on r/MedSpa makes the shape of the problem explicit: owners describe agencies that "promised the world — Meta ads, Google ads, SEO, social media" and under-delivered on all of it at once. The common thread isn't incompetence. It's an engagement that was never structured to be checked. No contract clause on asset ownership. No defined reporting cadence. No one asking about PIPEDA before touching patient data. This guide is the checklist to run before you sign — not after you've paid for the lesson.
THE CHECKLIST
The vetting checklist
Four line items separate a studio you can audit from one you can't. Ask about each before you sign anything — not during a quarterly review six months in.
Ownership. Who owns the domain, the CMS, the ad accounts, and the patient-facing content once the contract ends? If the honest answer is "we do," that's your answer. A studio that hands you a design system and the live files on day one is building something you keep, not something you rent.
Contract length. Month-to-month retainers signal confidence in the work. Twelve-month lock-ins with auto-renew clauses signal the opposite — compare a design-subscription model against a project-based studio before you commit to either shape of engagement.
Reporting cadence. Weekly numbers beat quarterly narratives every time. Ask what dashboard you'll see, who updates it, and how often — a vague answer here is the single fastest thing to catch on a discovery call.
Compliance literacy. Any agency touching booking pages or patient forms should know PIPEDA without hesitation and name a HIPAA business associate agreement before you bring it up.
| Vet point | What to ask | What it predicts |
|---|---|---|
| Ownership | Who owns the domain, CMS, ad accounts, and content after the contract ends? | Whether you can leave without rebuilding from zero |
| Contract length | Is this month-to-month, or locked for 12 months with auto-renew? | Whether results — or the lock-in — are the real product |
| Reporting cadence | How often do I see real numbers, not a narrative recap? | Whether performance is visible or just promised |
| Compliance literacy | Can you name PIPEDA and a BAA without me asking first? | Whether patient data is handled correctly from day one |
RED FLAGS
Red flags that predict a bad engagement
Red flags rarely show up as a single bad sentence. They show up as a pattern across the discovery call, the proposal, and the contract itself. Owners who've been through a bad engagement describe the same handful of signals after the fact.
A vague scope is the first tell — a proposal that lists "SEO, social, ads, content" with no deliverable attached to any of them. A locked CMS is the second: if your site lives inside the agency's proprietary builder, you don't own it, you rent it, every month, for as long as you stay. A reporting cadence that's labeled "monthly" but arrives as a PDF of screenshots instead of numbers is the third. And an agency that can't answer a direct compliance question — PIPEDA, a disclosure statement, consent-aware before-and-after galleries — on the spot is the fourth.
None of these alone is fatal. Three or more together is the pattern owners describe after spending on marketing that never produced results, and it's worth noting before you sign rather than discovering it in month six.
| Red flag | What it predicts |
|---|---|
| Vague scope — "SEO, social, ads" with no deliverable | No accountability once the invoice is paid |
| Proprietary or locked CMS | You rent the site; you don't own it |
| Monthly PDF instead of live numbers | Performance is narrated, not shown |
| Can't answer a compliance question on the call | Patient data risk down the line |
| No month-to-month option offered | The retainer, not the result, is the product |
THE CALL
Questions to ask on the call
A 20-minute discovery call tells you more than a proposal ever will — if you ask four direct questions and listen for direct answers.
"What do I own if I leave in 90 days?" A studio that answers instantly, by name — domain, CMS export, ad account access — has done this before. Hesitation is the answer.
"Show me a dashboard from a current client." Not a case study slide — a live or recent report. If they can't show one, they may not track the thing they're selling you.
"What's your process if a patient-facing form collects health information?" This single question filters out agencies that have never built a HIPAA- or PIPEDA-aware booking flow. The answer should be specific, not "we're careful."
"What does month four look like if results are slow?" A straight answer here — "we adjust the plan, and here's how" — beats a defensive one every time. Owners who've worked with a couple hundred agencies note the same thing: the good ones treat a slow month as a planning input, not a reason to hide the numbers.
Free, no commitment. Takes 2 minutes — that's the kind of clarity a real vetting call should deliver before you ever sign a retainer.
FAQ
Common questions.
What are the biggest medspa marketing agency red flags?
A vague scope with no attached deliverables, a locked or proprietary CMS, monthly reports that are screenshots instead of numbers, and an inability to answer a direct compliance question on the discovery call. Three or more together is the pattern owners describe after a bad engagement.
What should a medspa agency contract checklist include?
Four line items: who owns the domain, CMS, and ad accounts after the contract ends; whether it's month-to-month or locked for 12 months; the reporting cadence and format; and whether the agency names PIPEDA or a HIPAA business associate agreement without prompting.
How do I know if a medspa marketing agency is a scam?
Watch for pressure to lock into a long contract before seeing a live dashboard, vague language about "strategy" with no attached deliverable, and no clear answer on who owns your site and ad accounts if you leave. A scam hides the exit; a studio shows you the door on day one.
Should I sign a 12-month contract with a marketing agency?
Only if the agency also offers month-to-month and you're choosing the longer term for a discount, not because it's the only option. A studio confident in its results doesn't need to lock you in to keep you.
Does a web design studio need to know HIPAA or PIPEDA?
Yes, if it touches booking pages, consent forms, or before-and-after galleries that collect health information. Ask for specifics on PIPEDA and a HIPAA business associate agreement — a vague answer here is a compliance risk, not a technicality.
What's a reasonable reporting cadence for a medspa marketing retainer?
Weekly access to a live dashboard, not a quarterly narrative recap. If the only reporting offered is a monthly PDF of screenshots, ask what you're actually paying to see.