Patient Reactivation for Medspas | Quarterly Recall Campaigns

Q: Is patient reactivation HIPAA compliant?

We follow a HIPAA-conscious process for every engagement. Before any patient data is accessed, we sign a Business Associate Agreement (BAA) with your clinic. We use minimum-necessary data — name, contact info, last visit date — and handle it with encrypted storage and transmission. We don't claim HIPAA certification, but we take the legal and ethical obligations around patient data seriously and document our process.

Q: What if a patient doesn't want to be contacted?

Every message includes a clear opt-out. Patients reply STOP and are immediately removed from all further outreach — permanently. We track opt-outs, never re-contact removed patients, and report the suppression list back to you.

See It In Action

How It Works

Quarterly campaign structure.

The list

Your own relationships

We pull your lapsed patient database — patients who visited once or regularly and then went quiet, typically 6–18 months since their last appointment. No cold data, no outside sourcing.

The outreach

Under your clinic's name

Personalized SMS, email, and live human recall calls go out under your clinic's name. Messages are warm and direct — not a mass blast. Patients hear from a brand they already chose.

The booking

Back to your calendar

Interested patients route back to your existing booking flow. Nothing in your current systems changes. You pay a commission on revenue from patients who actually book.

In Practice

What a campaign looks like.

Campaign snapshot

Maryland Medspa · 447 Dormant Patients · 2026

447 dormant patients
contacted

107 responded to
initial outreach

29 booked within
14 days

6hrs to first booking
after launch

Representative of a typical reactivation campaign. Individual results vary by list size, patient recency, and clinic specialty.

Patient Data & Privacy

How we handle patient data.

We sign a Business Associate Agreement (BAA) with every client before any patient data is exchanged.
We use minimum-necessary data only: name, contact information, and last visit date.
All data is handled with encrypted storage and transmission.
Every message includes a clear opt-out. STOP replies are honored immediately and permanently.
We maintain a written Do-Not-Call policy, available on request.
Recall calls are made by live humans on your clinic's behalf — never robocalls, never AI voices.
Patient data is returned or deleted at the end of the engagement, per your preference and our BAA.

We use the phrase "HIPAA-conscious process" deliberately. We follow the obligations seriously and document everything. We don't make a certification claim we can't back up.

FAQ

Common questions.

How does patient reactivation work for medspas?

We start with your existing patient database — specifically people who haven't visited in 6 to 18 months. We build an outreach list, send personalized SMS, email, and make recall calls on your behalf, and route interested patients back to your booking flow. Campaigns run quarterly. You pay a commission on revenue from patients who actually rebook.

Is patient reactivation HIPAA compliant?

We follow a HIPAA-conscious process. Before any patient data is accessed, we sign a Business Associate Agreement (BAA) with your clinic. We use minimum-necessary data — name, contact info, last visit date — with encrypted storage and transmission. Opt-outs are honored immediately. Data is returned or deleted at engagement end. We don't claim HIPAA certification, but we take these obligations seriously and document the process.

What do the outreach messages actually look like?

Messages go out under your clinic's name and read like a personal check-in from your team — not a mass marketing blast. A typical first SMS might say: "Hi [Name], it's been a while since your last visit at [Clinic Name]. We'd love to welcome you back — reply here or give us a call to schedule." We review and finalize all messaging with you before anything sends. Nothing goes out until you've approved it.

What if a patient doesn't want to be contacted?

Every message includes a clear opt-out. Patients reply STOP and are immediately removed from all further outreach — permanently. We track opt-outs, never re-contact removed patients, and report the suppression list back to you. Compliance is built into the sequence from the start.

How is this different from SMS marketing I've tried before?

Broadcast SMS goes to a cold or promotional list. Reactivation goes to patients who already chose your clinic, experienced your care, and drifted for reasons usually unrelated to dissatisfaction. A personalized, well-timed message to that audience lands in a completely different context. The channel is the same. The relationship isn't.

Do you need access to our booking system or EMR?

No. You provide a simple patient export — name, phone number, last visit date — and we handle everything from there. Interested patients are directed back to your existing booking flow. Nothing in your current systems changes.

What happens to patient data when the campaign ends?

Patient data is returned or deleted at the end of the engagement per your preference and under the terms of our BAA. We do not retain, resell, or use patient data for any purpose outside of the active reactivation campaign.