For medspa owners and operators

Grade an AI vendor before you sign.

Ask these 34 questions before you sign any AI tool that answers calls, sends texts, books appointments or follows up with patients. Grade each answer and get a clear decision: stop, pilot only, or go ahead with a pilot.

  • 34 questions
  • 15 for the call
  • Saves as you go
  • No sign-up required

How to use it

  1. Send the 19 written questions ahead. Copy them below, paste them into an email to the vendor, and ask for written answers back.
  2. Ask the 15 call questions live. A good vendor answers them in a 30 to 45 minute call. A vendor who rushes you past them has already answered the most important one.
  3. Grade every answer. Write down what they said as you go. Your notes stay on this device.
Green
A clear, specific answer you can check, ideally in the contract.
Amber
A partial or verbal answer. Fine for a small pilot, not for a long contract.
Red
No answer, a vague answer, or "don't worry about that".

Deal-breakers are the 11 questions where a red answer stops the purchase, whatever else looks good. An amber on a deal-breaker must turn green before a pilot starts, because a pilot uses real patient data. Every other amber goes into the pilot's written terms.

The tool is there to support your team's judgment, not replace it. You decide what AI handles, what a person approves, and what stays human.

The vendor

Patient data and privacy

Your practice answers to patients for their data, whatever the vendor promises, so these answers matter most.

1CallDeal-breaker

Will you sign a business associate agreement (BAA) before we share any patient information?

A BAA is the contract US health privacy law (HIPAA) requires when a vendor handles patient information. If HIPAA doesn't apply to your practice, or you're in the UK, ask for a data processing agreement (DPA) with the same protections.

A good answer
Yes, before setup starts
Walk away if
They refuse, or say you don't need one because they are "HIPAA compliant"
Grade for question 1

2Written

Where is our data stored, and who at your company can see it?

A good answer
A named location, access limited by role, and every access logged
Walk away if
They can't say
Grade for question 2

3CallDeal-breaker

Do you, or the AI companies you use, train models on our conversations or patient data?

A good answer
No, in writing, covering every provider they use
Walk away if
"It's anonymized, so it's fine" with no detail
Grade for question 3

4Written

How long do you keep recordings, transcripts and messages, and can we change that?

A good answer
A stated period you can shorten
Walk away if
Everything is kept indefinitely
Grade for question 4

5Written

How quickly will you tell us about a data breach, and what happens next?

A good answer
A set number of days in the contract and a named contact
Walk away if
No written breach process
Grade for question 5

Whether HIPAA applies depends on how your practice operates, so check with your attorney. If you're not sure, it's safer to work as if it does, and state privacy laws may apply either way.

Human oversight and judgment

These questions show whether the tool supports your team or quietly replaces its judgment.

6Call

When does the AI hand a patient to a person, and how fast?

A good answer
Clear triggers you set, with a warm transfer or an alert within minutes
Walk away if
"It handles everything"
Grade for question 6

7Written

Can we require a person to approve certain messages before they send?

A good answer
Yes, by message type or topic
Walk away if
All-or-nothing automation only
Grade for question 7

8CallDeal-breaker

What will the AI refuse to do? Medical advice, treatment suitability, complaints?

A good answer
A list you can see and change, with clinical questions always passed to staff
Walk away if
It answers clinical questions on its own
Grade for question 8

9CallDeal-breaker

Can staff see and correct every conversation the AI has had, and who on your side reviews its mistakes?

A good answer
Full transcripts, searchable, with a way to flag errors, and a named person who reviews them on a set schedule
Walk away if
Only summaries, no access, or "the AI learns by itself"
Grade for question 9

10CallDeal-breaker

How do our staff pause the AI themselves, and what happens to calls and texts while it's paused?

A good answer
Staff can pause it within minutes from a setting they control, with calls and texts going to your team while it's off. For texts, staff can also take over a live conversation
Walk away if
Only the vendor can turn it off, or it needs a support ticket
Grade for question 10

Accuracy and brand voice

A wrong price or a robotic reply costs trust that took years to build.

11Written

Where does the AI get our prices, treatments and policies, and who keeps them current?

A good answer
From a source you control, updated by you, with a named owner
Walk away if
It scrapes your website and guesses
Grade for question 11

12Written

What happens when the AI doesn't know an answer?

A good answer
It says so and passes the patient to a person
Walk away if
It makes something up to keep the conversation going
Grade for question 12

13CallDeal-breaker

How do you stop it inventing prices, results or availability, or making claims our regulators or board would object to?

A good answer
Answers and claims limited to information and wording you approve, with tests to prove it
Walk away if
No specific safeguard, or "it writes its own marketing"
Grade for question 13

14Written

Can we set its tone, words to avoid, and how it introduces itself?

A good answer
Yes, in writing, and you approve the final version
Walk away if
One standard voice for every client
Grade for question 14

15CallDeal-breaker

Can we test it as a patient before it goes live?

A good answer
Yes, with a test line and test scripts, as often as you like
Walk away if
Testing only after launch
Grade for question 15

In the US, automated marketing texts and AI calls fall under the TCPA, and lawsuits can claim $500 per message, or up to $1,500 if the violation was willful (47 U.S.C. § 227(b)(3)). Ask these before any promo campaign.

16CallDeal-breaker

How do you capture and store each patient's consent to marketing texts?

A good answer
Written consent recorded with date, wording and source
Walk away if
"Anyone who gave a number has opted in"
Grade for question 16

17CallDeal-breaker

What happens when a patient replies STOP or asks to opt out in their own words?

A good answer
Honored automatically across every channel, with a log
Walk away if
Manual handling only
Grade for question 17

18Written

Do you block messages outside allowed hours in the patient's time zone?

A good answer
Yes, by default
Walk away if
Messages go out whenever a campaign runs
Grade for question 18

19Written

Does the AI tell patients they are talking to AI where the law requires it?

A good answer
Yes, and you can choose to disclose everywhere
Walk away if
It is designed to pass as human
Grade for question 19

20Written

How do you handle before-and-after photos and other images patients send?

A good answer
Kept out of marketing unless the patient has given separate written consent
Walk away if
No rules for images
Grade for question 20

Rules differ by state and change often, so confirm the details with your attorney. For UK practices, check UK GDPR and PECR before any marketing texts go out.

Setup and fit

The best tool on paper fails if it doesn't fit how your front desk works.

21Call

Does it connect directly to our booking system and calendar?

A good answer
A named, live integration that books in real time
Walk away if
Double entry, or "coming soon"
Grade for question 21

22Written

Who sets it up, and how many hours will our team need to give?

A good answer
A named person on their side, with your hours estimated in writing
Walk away if
"It's self-serve" with no support
Grade for question 22

23Written

How long from signing to live, and what could delay it?

A good answer
A dated plan with the dependencies listed
Walk away if
No timeline
Grade for question 23

24Written

What training do our staff get, and who do they call when something breaks?

A good answer
Training included, a support channel and response times
Walk away if
Help articles only
Grade for question 24

25Written

How does it handle our busiest days, such as a Black Friday launch?

A good answer
Capacity limits stated, with a fallback to staff
Walk away if
Untested at peak volume
Grade for question 25

Price, contract and exit

Know the full cost and the way out before you sign.

26Call

What is the total monthly cost per location, including usage, phone numbers and add-ons?

A good answer
One written figure covering everything
Walk away if
Fees appear only after signing
Grade for question 26

27Written

What happens if we go over the call or message limit in a busy month?

A good answer
Stated overage rates, and an alert before you hit the cap
Walk away if
Service stops or costs jump without warning
Grade for question 27

28Written

How long is the contract, and what does it cost to leave early?

A good answer
Month-to-month or a short term with clear exit terms
Walk away if
A long lock-in with heavy exit fees
Grade for question 28

29Written

Can the price rise during the contract, and with how much notice?

A good answer
Fixed for the term, with written notice before any change
Walk away if
Changes at their discretion
Grade for question 29

30CallDeal-breaker

If we leave, what do we keep, and how do you return and delete our data?

A good answer
You keep your data, phone numbers, scripts and workflows. Export in a standard format. Deletion by a set deadline, covering backups and the AI providers they use, confirmed in writing
Walk away if
They keep the phone number patients know, no export, or deletion "on request" with no deadline
Grade for question 30

Proof

Ask for evidence from practices like yours, not industry averages.

31Written

Can we speak to two medspas of our size that use this today?

A good answer
Names and contacts, offered without hesitation
Walk away if
Logos only, no one to call
Grade for question 31

32Written

What did those practices measure before and after, and over what period?

A good answer
Their own before-and-after numbers with dates
Walk away if
Only industry statistics
Grade for question 32

33Call

Can we start with a short pilot on one workflow, with conditions for stopping, and add more later?

A good answer
A 30 to 60 day pilot with written stop conditions, priced per workflow
Walk away if
A full contract or an all-or-nothing bundle before any trial
Grade for question 33

34CallDeal-breaker

What results do you promise, and what happens if we don't get them?

A good answer
Honest ranges, with a remedy if agreed service levels are missed
Walk away if
Guaranteed revenue or booking numbers
Grade for question 34

One red flag you see rather than ask

This scorecard is general guidance, not legal advice or a compliance certification. Confirm legal and privacy questions with your attorney.

So farNot ready to decide