Key takeaways
- Booking and payments is its own decision—these are light booking-layer tools, so pair them with a dedicated EMR or upgrade to a practice-management platform for clinical charting.
- HIPAA is the key filter: Fresha, GlossGenius, Acuity (Powerhouse), SimplyBook.me, Setmore, vcita, and Square market HIPAA/BAA support; Booksy, Timely, Schedulicity, and DaySmart are not HIPAA—always confirm the BAA in writing.
- Deposits, card-on-file, and automated reminders are the highest-ROI no-show defenses for an injectables calendar.
- Payment economics vary by model: Fresha's free subscription plus ~20% marketplace fee vs Square and GlossGenius flat rates vs tiered subscriptions—model your real volume.
- Match the tool to your stage: lean HIPAA-capable picks for solo injectors, mature payments for single locations, POS-and-membership platforms for spa-style multi-location.
- MSVH scores cluster tightly (3.6–4.3)—choose for fit, not for the single highest number.
Booking and payments is the engine room of a med spa: it controls how clients find an open slot, how you protect that slot with a deposit, and how much of each transaction survives processing fees. It deserves its own decision—separate from the bigger question of a full practice-management or EMR suite. The platforms in this guide are the lighter booking-layer tools: they win on self-scheduling, payments, and client experience, but they are not clinical charting systems. If you inject neuromodulators or fillers, run lasers, or need defensible documentation and good-faith-exam workflows, you will either pair one of these with a dedicated EMR or upgrade to a heavier practice-management platform. Browse the full lineup in our booking and payments category.
Why booking + payments is its own decision
It is tempting to assume the calendar comes bundled with everything else. In practice, the booking layer and the clinical layer solve different problems and are often best bought—and judged—separately. A great booking tool reduces front-desk friction, fills your calendar, and processes payments cleanly. A great EMR keeps you compliant and defensible in the chair. The tools below are excellent at the former and intentionally light on the latter. For a solo injector or a single-location spa whose charting needs are modest (or handled in a paired system), a focused booking-and-payments platform is often cheaper, faster to deploy, and more pleasant to use than a sprawling all-in-one. It also means you can judge this purchase on the metrics that move revenue today—calendar fill rate, no-show protection, and effective processing cost—rather than on clinical features you may not need yet. Just go in knowing the ceiling: when your documentation needs grow, you'll add an EMR or migrate, so favor tools whose data and payment tokens are portable.
HIPAA & compliance — the key med-spa filter
This is the single most important screen, and it eliminates several otherwise-good options. A med spa handles protected health information, so your booking tool needs a signed Business Associate Agreement (BAA), encryption, role-based access, and audit logging. Many consumer-grade booking tools simply will not sign a BAA—which makes them unsuitable for medical use no matter how nice the calendar looks.
Among these twelve, the ones that market HIPAA support and/or a BAA:
- Fresha — offers HIPAA-aligned handling for medical/health businesses.
- GlossGenius — markets HIPAA compliance for medical and wellness providers.
- Acuity Scheduling — HIPAA features are available only on the Powerhouse tier with a signed BAA.
- SimplyBook.me — offers a dedicated HIPAA module (paid add-on) on a budget.
- Setmore — markets a Setmore Health / HIPAA capability.
- vcita — offers a HIPAA business account.
- Square Appointments — Square supports HIPAA for eligible forms/health workflows with a BAA.
The ones that are not positioned as HIPAA-compliant for medical PHI:
- Booksy — beauty-marketplace focused, not HIPAA.
- Timely — beauty-led, not HIPAA.
- DaySmart Salon & Spa — salon/POS focused; best where HIPAA is not a hard requirement.
- Schedulicity and similar consumer tools — not HIPAA.
Tippy is a cashless-tipping and payouts layer rather than a full booking system, so it sits alongside whatever scheduler you choose. Whichever vendor you pick, always confirm the BAA in writing—marketing copy is not a contract.
Capabilities that matter
Weigh these against how your front desk actually runs:
- Online self-booking: real-time availability by service and qualified provider, plus room/resource handling.
- Deposits & no-show protection: card-on-file, required deposits, and cancellation windows are the highest-ROI feature for an injectables calendar.
- Memberships, packages & gift cards: recurring billing that re-bills and dunns failed cards, package balances that decrement correctly, and gift-card support.
- Integrated card processing / POS: in-person and online payments, with hardware (terminals, readers) where you take walk-in retail.
- Payment processing rates: the effective percentage you pay on every dollar (covered below).
- Automated reminders: SMS and email reminders that measurably cut no-shows.
- Client / marketplace acquisition: some platforms (Booksy, Fresha) bring new clients via a consumer marketplace—useful, but it comes with a fee.
Payment economics
The subscription is rarely the biggest number. There are three cost models, and they scale very differently:
- Free/low subscription + marketplace fee: Fresha charges $0/mo for core software and processes payments around 2.19%–2.29% + $0.20 per transaction—but takes a ~20% commission on new clients booked through its marketplace. That marketplace fee is the line that surprises people; it is great for acquisition and expensive at volume.
- Flat-rate processing + simple sub: Square Appointments (Free, $49, $149/mo) and GlossGenius ($24–$48/mo) bundle predictable flat-rate processing—easy to model, no marketplace commission.
- Tiered subscriptions: Acuity ($20–$61/mo), SimplyBook.me (free–$59.90/mo), vcita, Timely, Booker (from ~$139/mo), and DaySmart charge mainly by plan and seats, often with processing layered on top.
Do the math on your average ticket and monthly volume. A platform with a higher subscription but lower processing can beat a "free" one once you cross a few thousand dollars a month. For a full breakdown, see our pricing guide.
Match to your stage and size
- Solo injector: keep it lean and HIPAA-capable. GlossGenius (beautiful all-in-one), Acuity on Powerhouse (flexible self-scheduling with deposits and a BAA), or Setmore/SimplyBook.me on a tight budget.
- Single location, multi-provider: Square Appointments for mature payments, vcita for booking plus light CRM, or Fresha when marketplace acquisition is a priority.
- Multi-location / spa-style: Booker for mature POS and memberships, or DaySmart for established salon-style booking and POS where HIPAA is not a hard requirement.
Our independent MSVH scores cluster tightly (3.6–4.3), so fit beats the top number nearly every time.
Demo / trial checklist
Drive the demo yourself and confirm:
- Will you sign a HIPAA BAA, on which plan, and what does it cover?
- Show the full flow: online booking → required deposit → reminder → check-in → checkout → rebook.
- What is the effective processing rate, and are payments locked to your processor?
- Is there a marketplace or new-client commission, and how is it calculated?
- How do memberships re-bill, and how are failed cards handled?
- What hardware is supported for in-person payments?
- Contract length, and what happens to my data and card-on-file tokens if I leave?
Common mistakes
- Ignoring HIPAA—buying on calendar polish and discovering the vendor won't sign a BAA.
- Underestimating processing fees—the percentage on every transaction quietly outweighs the subscription.
- Marketplace-fee surprises—a "free" platform's new-client commission can dwarf a flat monthly plan at volume.
- Skipping deposits—leaving the single best no-show defense turned off.
- Outgrowing the booking layer—forgetting these are light on clinical charting and needing to pair or upgrade later.
Ready to go deeper? Browse the full booking and payments category for our independent reviews, and if you've narrowed it to the two leading low-overhead payment-first tools, our Fresha vs Square Appointments comparison breaks down exactly where each one wins.
Frequently asked questions
Do I need HIPAA-compliant booking software for a med spa?
Yes, if you handle protected health information—which most med spas do. You need a vendor that will sign a Business Associate Agreement (BAA) and provide encryption, role-based access, and audit logging. Among these tools, Fresha, GlossGenius, Acuity (on the Powerhouse tier), SimplyBook.me, Setmore, vcita, and Square market HIPAA support, while Booksy, Timely, Schedulicity, and DaySmart are not positioned for medical PHI. Always confirm the BAA in writing before you sign.
Is a booking platform enough, or do I also need an EMR?
The tools in this guide are the lighter booking-and-payments layer—great for scheduling, deposits, and payments, but light on clinical charting. If you inject, run lasers, or need defensible documentation and good-faith-exam workflows, you'll pair one of these with a dedicated aesthetics EMR or upgrade to a fuller practice-management platform. A solo injector with modest charting needs can often run on a single booking tool; higher clinical volume usually means adding or moving to a real EMR.
What hidden payment costs should I watch for?
Two big ones. First, the processing rate—the percentage plus per-transaction fee on every dollar, often larger than your subscription over a year. Second, marketplace or new-client commissions: Fresha, for example, is free to subscribe but charges around 20% on new clients booked through its marketplace. Flat-rate processors like Square and GlossGenius are easier to model. Calculate the effective cost against your real average ticket and monthly volume, not the headline price.
How do deposits and no-show protection actually work?
Most of these platforms let you capture a card on file at booking and require a deposit or full prepayment, then enforce a cancellation window so late cancels or no-shows are charged automatically. Paired with automated SMS and email reminders, this is the highest-return feature for an injectables calendar, where a single missed appointment can cost hundreds. Confirm during the demo that deposits, cancellation fees, and reminders are all included on the plan you're quoted.
Which platform fits a solo injector versus a multi-location med spa?
A solo injector should stay lean and HIPAA-capable—GlossGenius for a polished all-in-one, Acuity on Powerhouse for flexible self-scheduling with deposits and a BAA, or Setmore and SimplyBook.me on a tight budget. Single locations wanting mature payments often pick Square Appointments or vcita, and Fresha when marketplace acquisition matters. Spa-style multi-location operations leaning on POS and memberships tend toward Booker or DaySmart, the latter where HIPAA is not a hard requirement.
