GEO for med spas and cosmetic practices: clear facts, careful claims

For a med spa or cosmetic practice, GEO (generative engine optimization, the work of being found and cited by AI assistants) is mostly a matter of stating verifiable facts clearly: which treatments you offer, who performs them and under what license, who owns and supervises the practice, where you are, and what a visit involves. The harder part is what you leave out. Health claims, before-and-after photos, testimonials and replies to reviews are all regulated, and content written to be quoted by an AI assistant is still advertising.

People can ask assistants questions such as "who does lip filler near me and is the injector a nurse or a doctor," "what's the difference between a med spa and a dermatologist for laser hair removal," or "what should I ask before a chemical peel."

No one can guarantee that ChatGPT, Gemini or Google's AI features will name your practice. This article is general information, not legal, medical or compliance advice. Have counsel who knows your state review your marketing.

Why this content is held to a higher standard

Google's guidance on helpful content says: "our systems give even more weight to content that aligns with strong E-E-A-T for topics that could significantly impact the health, financial stability, or safety of people, or the welfare or well-being of society." Google calls these "Your Money or Your Life" topics. The same page says E-E-A-T (experience, expertise, authoritativeness and trustworthiness) "itself isn't a specific ranking factor."

We found no more specific Google statement about how AI Overviews or AI Mode treat cosmetic or medical questions, and no statement from OpenAI, Anthropic or Perplexity on how their assistants choose a cosmetic provider. So write for the patient, show who is responsible for the content, and keep every claim within what you can support. Our guides to GEO for healthcare websites and GEO for doctors cover the wider health context.

What to state clearly on your site

Give each treatment its own page that states the following.

A licensed clinician should write or sign off on anything about safety, suitability or results.

Provider credentials and ownership

Each clinician should have a profile with license type, license number, the issuing board, training and the treatments they perform. What makes a good profile page is covered in about pages and author pages for GEO.

Ownership and supervision rules are set by states. As one example, the Medical Board of California's page on medical spas says: "Medical spas are marketing vehicles for medical procedures. If they are offering medical procedures, they must be owned by physicians." The same page says treatments such as injections and lasers must be performed by qualified medical personnel, which in California "means a physician, or a registered nurse or physician assistant under the supervision of a physician."

California Business and Professions Code section 651, covered below, also says a physician licensed by the Medical Board of California and certified by a qualifying board shall not use the term "board certified" unless the full name of the certifying board is also used and given comparable prominence. California is the only state checked for this article. This is not legal, medical or compliance advice.

Business Profile and structured data

Google's Business Profile help says health and beauty businesses can add a booking button and update their list of services, and its guidelines say individual practitioners may have separate pages. Keep the practice name, address, phone and hours identical on the profile, on Bing Places and in your site footer.

For structured data, Google's LocalBusiness documentation requires a name and an address and says to use the most specific subtype. Schema.org lists medical subtypes including MedicalClinic, Dermatology, PlasticSurgery and Physician. Google says structured data isn't required for its generative AI features, and treats reviews of your own practice marked up on your own site as ineligible for review stars.

Health claims and testimonials: the FTC's standard

The FTC staff's Health Products Compliance Guidance is written for marketers of health-related products and doesn't mention med spas or procedures. It is business guidance that, in its own words, "doesn't have the force or effect of law," and it says "the same legal principles apply to the marketing of any health-related product." Its two principles are:

• "Advertising must be truthful and not misleading."
• "Before disseminating an ad, advertisers must have adequate substantiation for all objective product claims conveyed, expressly or by implication, to consumers acting reasonably."

On evidence, the guidance says health benefit and safety claims "require substantiation in the form of competent and reliable scientific evidence," and that as a general matter this will need to be randomized, controlled human clinical testing.

On testimonials, it says: "It's not enough that a testimonial represents the honest opinion or experience of an endorser." Advertisers must also have scientific evidence for the implied claim that the product will work for buyers as it did for the endorser. And on the familiar disclaimer: "attempts to disclaim dramatic results with statements like 'Results not typical' don't cure the deception." It says such testimonials should carry "a clear and conspicuous disclosure of the results a typical consumer can actually expect."

This is not legal, medical or compliance advice, and it does not tell you whether a particular claim is permitted.

Before-and-after photos: California as one example

State law can be more specific than FTC guidance. California Business and Professions Code section 651 (as amended effective January 1, 2018) covers public communications by licensed health professionals, including on the internet. Among its provisions:

If you practice elsewhere, look up your own state's statute and licensing board. This is not legal, medical or compliance advice.

FDA wording: approved, cleared, compounded

The FDA's consumer page Is It Really "FDA Approved"? (current as of May 4, 2026) explains the differences.

• Approval and clearance are different. The FDA says the highest-risk devices generally require approval of a premarket approval application, while manufacturers of moderate-risk devices may generally market them through 510(k) clearance.
• Registration is not approval. "Mere registration of an establishment or listing of a drug or device does not denote approval."
• Cosmetics and compounded drugs. "The FDA doesn't approve cosmetics." "The FDA doesn't approve compounded drugs."

The FTC's guidance adds that advertisers "should be careful not to mischaracterize the extent to which a product or claim has been reviewed, authorized, or approved by the FDA."

If you offer weight-loss medication, read the FDA's page FDA's Concerns with Unapproved GLP-1 Drugs Used for Weight Loss (current as of October 1, 2026). It says the agency "does not review compounded drugs for safety, effectiveness or quality before they are marketed." Among the warning signs it lists for consumers is a seller that "makes claims such as the compounded drug is the same as an FDA-approved drug." This article doesn't cover when compounding is permitted; that is a question for your counsel. This is not legal, medical or compliance advice.

Reviews and patient privacy

Google's review policies apply as to any business: no incentives, no selective soliciting of happy patients, no reviews by staff.

The added risk in health care is the reply. The HHS Office for Civil Rights published a settlement with a New Jersey provider of psychiatric services (page last reviewed June 5, 2023). It resolved a complaint alleging that the provider "impermissibly disclosed the protected health information of a patient when the entity posted a response to the patient's negative online review." HHS described potential violations of the HIPAA Privacy Rule, and the provider "paid $30,000 to OCR and agreed to implement a corrective action plan."

Whether HIPAA applies to your practice depends on facts this article can't assess, and the HHS page gives no instructions for replying to reviews. A cautious practice, for your privacy counsel to approve, is a generic reply that reveals nothing about the person, doesn't confirm that the reviewer is a patient and invites them to call the office.

Analytics and ad pixels need the same care. HHS's bulletin on online tracking technologies says tracking technologies on a regulated entity's unauthenticated page that lets people schedule appointments "may have access to PHI in certain circumstances" (PHI is protected health information). A federal court vacated one part of that bulletin on June 20, 2024, the part about connecting an IP address with a visit to a public page on specific health conditions or providers. The HHS page, last reviewed June 26, 2024, says HHS is evaluating next steps. This is not legal, medical or compliance advice.

How to measure without overreaching

Search Console's Generative AI performance report shows impressions in Google's AI Overviews and AI Mode by page. Bing Webmaster Tools' AI Performance report covers citations in Copilot and Bing's AI summaries.

Google Analytics 4 has an AI Assistant channel for visits from assistants such as ChatGPT and Copilot; what it counts is explained in the AI Assistant channel in GA4. Before analytics or ad tags go on booking or intake pages, get your privacy counsel's review.

Once a month, put a fixed list of patient questions to the main assistants and record whether you appear and whether the details are right. If an answer is false, see what to do when AI says something wrong about your business.

What to do first

1. Confirm ownership, supervision and license details and publish them on provider and about pages.
2. Bring your Business Profile, Bing Places listing and site footer into exact agreement.
3. Have counsel review existing claims, testimonials and before-and-after galleries against FTC guidance and your state's law.
4. Correct every "FDA approved" and "FDA cleared" statement against the FDA's records.
5. Rewrite treatment pages with the facts in the table above, signed off by a clinician.
6. Adopt an approved template for review replies, and start the monthly check.

Be wary of any vendor that promises placement in AI answers; see our guide to GEO guarantee red flags.

Conclusion

For med spas and cosmetic practices, the content that is safest to publish is also the most useful to patients: who you are, who treats, what the visit involves, what things cost, and claims you can support. None of it guarantees a mention in an AI answer. eSEOspace offers a free GEO audit of site structure and visibility; it is not a medical or compliance resource. More guides are in our GEO and AEO Guide.

Frequently asked questions