Websites for Dentists and Med Spas: Booking That Fills the Chair

A new patient arrives with one question and a phone. For a dentist it is usually whether you take their insurance and when you can see them. For a med spa it is what the treatment costs and whether the person doing it is qualified. Everything on the first screen should answer those and offer a way to book.

The comparison is happening in a browser tab next to two other practices. In Irvine the population skews toward professionals who research before making contact. Pasadena residents vet the people who work on them the way they vet contractors, by institution and credential. In Orange County the franchise brands blanket the county with ads and raise what a legitimate practice’s site is expected to look like. Your site is judged against that, on a phone, in about ten seconds.

1. First screen: what you do, where you are, a photo of the actual room or team, and one button that books.
2. Second screen: the treatment menu with starting prices or price ranges, one line each.
3. Third screen: insurance accepted, financing offered, and the new-patient offer if you run one.
4. Fourth screen: reviews pulled live from Google, then the doctor or medical director with license and credentials.
5. Everywhere: tap-to-call, and the booking button fixed to the bottom of the phone screen.

The booking button should open a real scheduler that shows available times and confirms, not a form that says someone will call you. Practice management systems and their scheduling add-ons can expose live availability to the website; a med spa without one can use a booking tool with a calendar embed. Either way, the patient picks a time and gets a confirmation by text within seconds.

Keep the first step small: name, phone, what they want, a time. Insurance details, medical history and consent come after the appointment is held, through the practice portal or the intake link in the confirmation text. Every field you add to the first screen costs bookings.

Calls do not stop because there is a scheduler. A dental office at 7pm and a med spa on a Saturday still miss the calls that turn into consultations. The Sitesmith AI Receptionist, at $299 a month, answers every call, knows your services and hours, books into your calendar and texts you a summary. Missed-call text back, appointment reminders and rebooking links are part of Automations at $99 a month.

Say which plans you accept by name, and say what happens if the patient is out of network. Say whether you offer a membership plan for patients without insurance and what it covers. A page that says we accept most insurance answers nothing and sends the patient back to the search results.

Financing is the page that turns a consultation into a case for implants, clear aligners, veneers or a laser package. State the financing partners you work with and what a monthly payment looks like for a typical case, using the calculator the lender provides so the numbers are theirs. Sitesmith can embed a financing calculator on the page as an add-on.

On prices, California is specific. Business and Professions Code section 651 requires that any advertised price be exact, without phrases like "as low as" or "and up", and that comparative price claims be backed by verifiable data. It also bars any statement likely to create a false expectation of results. The practical version: publish a starting price or a range for each treatment, say what it includes, and keep it current. A treatment menu with real prices is also what an AI assistant quotes when someone asks what Botox costs in Glendale.

California BPC 651: advertised prices must be exact. No "as low as", no "and up".

Before-and-after galleries sell cosmetic dentistry and aesthetics better than any paragraph, and they are the part of the site most often built wrong. A patient photo is protected health information. Using it for marketing requires a HIPAA authorization under 45 CFR 164.508, which must describe the information, name who may use it and who receives it, state the purpose, carry an expiration, and be signed and dated, with a notice that the patient can revoke it in writing. A line in the intake packet does not meet that standard. A separate photo release does.

California adds its own rules under BPC 651. Before-and-after images must be comparable in presentation, the same lighting, angle and framing, so the result is not exaggerated. The ad must state that results may not occur for all patients. Any photo of a model rather than a patient must say so prominently.

Ad platforms have positions too. Meta’s health and wellness standards allow cosmetic before-and-after images for adults and require cosmetic procedure ads to target people 18 or older, while prohibiting statements that attack a person’s appearance and clickbait weight-loss claims. Google’s health personalized advertising policy lists invasive procedures including cosmetic surgery and injections as sensitive, which rules out advertiser-built audiences such as remarketing lists for those campaigns.

• A signed, dated, specific photo authorization for every patient in the gallery, stored where you can find it.
• Same angle, distance, lighting and no makeup changes between the before and the after.
• Treatment named, number of sessions stated, results-vary language on the gallery page.
• No faces on the site without explicit consent for the face; crop where the patient asked.
• Remove a photo the day a patient revokes, and keep the revocation on file.

HHS guidance on online tracking technologies draws the line. Tracking on a plain informational page, your location, hours or careers, is generally outside HIPAA. Tracking on a page where a person schedules an appointment or enters a reason for a visit may collect protected health information, because a name or email plus a reason for care is individually identifiable health information. HHS gives the example of a clinic whose appointment page sends the appointment details and the visitor’s IP address to a tracking vendor: the vendor is then a business associate and a business associate agreement is required.

HHS is also explicit that a cookie banner is not a HIPAA authorization. If a vendor collects PHI and is not under a business associate agreement, the practice needs each patient’s authorization before the data flows. In June 2024 a federal court in Texas vacated the part of the guidance that treated an IP address plus a visit to a public page about a health condition as PHI, and HHS notes it is evaluating next steps, but the appointment-page example and the business associate requirement stand.

1. Use a forms vendor that signs a business associate agreement, and route every appointment, intake and contact form through it.
2. Keep the Google Ads and Meta pixels off booking, intake and portal pages. Fire the conversion on a thank-you page that carries no form data.
3. Encrypt the form in transit and at rest, and do not email submissions to a personal inbox in plain text.
4. Log who on staff can see submissions and remove access when they leave.
5. Write a short privacy notice on the form itself saying what is collected and why.

Sitesmith builds the booking and contact flow on your chosen HIPAA-capable vendor and places the analytics where HHS says they can go. We do not sign a business associate agreement ourselves, and we say so up front.

Reviews decide which practice gets the consultation. BrightLocal’s 2026 survey of 1,002 US consumers found 97 percent read reviews for local businesses, 31 percent will only use a business rated 4.5 stars or higher and 47 percent will not use one with fewer than 20 reviews. Google allows asking patients for a genuine review and prohibits paying for one or asking only the happy ones. The FTC says the same about incentives conditioned on a positive review.

The trap is the reply. In December 2022 New Vision Dental in California paid $23,000 to settle with the HHS Office for Civil Rights after replying to Yelp reviews with patients’ full names and details of their visits, treatment and insurance, and agreed to two years of monitoring. OCR’s director called disclosing PHI in response to a negative review a clear no. A reply must never confirm the person was a patient, what they had done or when.

• Ask by text after every visit, every patient, with a direct link to the Google review page.
• Pull live Google reviews onto the site. The Standard build includes the widget.
• Reply to every review with a fixed script that thanks them, invites a call, and says nothing about care.
• Hand negative reviews to one person with the script, and take the conversation offline by phone.

They work when the landing page and the campaign are one thing, and when the treatment is worth enough to pay for the clicks. Implants, full-arch cases, clear aligners, veneers and laser or injectable packages are the treatments that justify paid search in Los Angeles and Orange County. A cleaning special does not.

The rules shape the campaigns. Google restricts prescription drug promotion, so a med spa ad should sell the consultation and the treatment category rather than a prescription product by name, and weight-loss products containing hCG are prohibited outright. Google’s health personalized ads policy excludes advertiser-curated audiences for cosmetic procedures and injections, so campaigns run on search intent and Google’s own audiences rather than a remarketing list of past visitors. Meta requires cosmetic ads to target adults 18 and older.

On the California side, the Medical Board is clear that a medical spa offering medical procedures must be owned by physicians, that injections and lasers must be performed by a physician or by a registered nurse or physician assistant under physician supervision, with the physician immediately reachable, and that cosmetologists may never inject the skin or use lasers. Your ads and your site should name the medical director and the credentials of the people doing the work. Practicing medicine without a license under BPC 2052 carries a fine of up to $10,000 and up to a year in county jail, and patients in this market check.

Sitesmith Ads management starts at $299 a month, run on your own billing so you own the account and the history. We build the landing page for the treatment, track calls and bookings back to the ad, and pause any campaign that stops paying for itself. For most practices the useful minimum is around $1,000 a month in spend; below that the data comes in too slowly to steer.