A med spa testimonial video needs three things before it goes online: a signed, specific authorization from the client, a story that reflects what clients generally experience, and a clear disclosure of anything you gave the client for appearing. Those three come from three rulebooks: the HIPAA Privacy Rule, the FTC’s Endorsement Guides and 2024 Consumer Review Rule, and, for Florida clinics, the state’s likeness statute. Get them right in planning and the shoot itself is the easy part. This guide covers each rule, how they change what happens on a shoot day, and what to ask on camera.

It’s part of our guide to med spa video production, which covers the full set of videos a clinic should make. This page goes deep on one of them.

Why do testimonial videos matter for a med spa?

Because aesthetic treatments are expensive, personal, and hard to judge from a menu. Prospective clients look for someone like them who has been through it. Northwestern’s Spiegel Research Center found that a product with five reviews is 270% more likely to be purchased than one with none, and that the lift was larger for higher-priced products (380%) than for lower-priced ones (190%). That research covers written reviews, not video. But the direction is clear: the more a decision costs, the more social proof matters.

A video testimonial carries more than a star rating. A viewer hears the client’s voice, sees that they’re comfortable, and gets a feel for your staff. It’s also the most regulated piece of content a med spa makes, because it combines health information, a real person’s face, and an advertising claim.

Do you need written consent for a med spa testimonial video?

Yes. If your med spa is a HIPAA covered entity, using a client’s identifiable information in marketing requires a written authorization. The Privacy Rule (45 CFR 164.508(a)(3)) says “a covered entity must obtain an authorization for any use or disclosure of protected health information for marketing,” with exceptions only for face-to-face communication and promotional gifts of nominal value. A testimonial on your website or Instagram fits neither exception.

Not every med spa is a covered entity. HIPAA coverage depends on whether you conduct certain health care transactions electronically, such as billing insurance, so some cash-pay clinics fall outside it. That doesn’t make consent optional. Two Florida laws still apply:

• Florida’s likeness statute. Fla. Stat. 540.08 says no person shall use “the name, portrait, photograph, or other likeness of any natural person” for a commercial or advertising purpose without that person’s express consent. A client who wasn’t asked can sue for damages, including a reasonable royalty.
• Florida’s patient-records law. Fla. Stat. 456.057(7)(a) bars licensed practitioners from discussing a patient’s medical condition with anyone outside the patient’s care “except upon written authorization from the patient.”

The practical answer is the same either way. Use a written authorization that meets the HIPAA standard, whether or not HIPAA strictly applies to you. It’s the strongest form you can have, and it protects you under every rule on this page. Confirm the details with whoever handles compliance for your practice. This guide isn’t legal advice.

What must a HIPAA marketing authorization include?

The Privacy Rule lists the required elements in 45 CFR 164.508(c). A valid authorization must contain:

1. A specific description of what’s being used. For a video: the client’s image, voice, name (full, first name only, or none), and the treatment discussed.
2. Who is using it. Your med spa by name.
3. Who it’s disclosed to. For marketing, that’s the public, through the channels you list (website, Instagram, TikTok, paid ads, email).
4. Each purpose. “Marketing and advertising for [clinic]” plus each channel.
5. An expiration date or event. A date (“24 months from signing”) or an event (“the end of the spring 2027 campaign”). The rule allows “none” only for research, so an open-ended “until revoked” doesn’t meet the standard.
6. The client’s signature and date.

It must also tell the client three things: they can revoke it in writing and how, you won’t condition their treatment on signing it, and once the video is public it can be shared beyond your control. It has to be in plain language, and the client gets a copy.

Two details that most med spa forms miss:

• Don’t bury it in intake paperwork. The rule generally bars combining an authorization with other documents into a “compound authorization.” Treatment consent and marketing consent are separate signatures.
• Disclose third-party money. If a device maker or product brand is paying for or co-funding the testimonial, 164.508(a)(3)(ii) says the authorization must state that remuneration is involved.

Key takeaway: A treatment consent form isn’t marketing consent. Every client who appears on camera signs a separate, plain-language authorization that names the channels, carries an expiration date, and explains how to revoke it.

What do the FTC rules say about med spa testimonials?

Two sets of federal rules apply to any testimonial used in advertising, whether or not HIPAA does.

The Endorsement Guides (16 CFR Part 255). These are the FTC’s interpretation of truth-in-advertising law. Four points matter most for med spas:

• It has to be honest and unedited in meaning. Endorsements “must reflect the honest opinions, findings, beliefs, or experience of the endorser,” and can’t be “reworded so as to distort” what the client said (255.1). Cutting for length is fine. Splicing words into a claim the client didn’t make isn’t.
• It’s read as typical. A testimonial about a key result is likely to be read as “what consumers will generally achieve.” If you can’t substantiate that, the ad should clearly disclose what people should generally expect (255.2(b)). “Results not typical” doesn’t do that job.
• Real clients only. People presented as actual clients have to be actual clients “in both the audio and video,” or the ad must clearly say they aren’t (255.2(c)).
• Disclose material connections. A free treatment, a discount, or a family or staff relationship has to be disclosed “clearly and conspicuously” if viewers wouldn’t expect it (255.5). In a video, the Guides say a disclosure should appear in both the visual and the audio when the claim is made in both.

The Consumer Review Rule (16 CFR Part 465). This one is an actual FTC rule, in effect since October 21, 2024, and almost no med spa marketing guide mentions it. It makes these practices violations:

• Fake testimonials. Creating or using a testimonial that misrepresents whether the person exists, whether they used your service, or what their experience was (465.2). The FTC’s Federal Register notice says plainly that “AI-generated reviews are covered by the final rule.”
• Paying for positive sentiment. Offering anything “conditioned expressly or by implication on” a review or testimonial “expressing a particular sentiment, whether positive or negative” (465.4).
• Undisclosed staff testimonials. Using a testimonial from your own officers, managers, or employees without clearly disclosing their relationship to the business (465.5).

Can you give clients a discount for a testimonial?

You can thank a client for their time, but you can’t buy a positive review. The line is precise. A credit offered for an honest testimonial, whatever the client says, is allowed, and the connection must be disclosed in the video or caption (255.5). A credit that depends on the client saying good things is banned under 465.4. In practice: make the offer before you know what they’ll say, keep it the same for everyone, never review footage before deciding whether to honor it, and add a line such as “This client received a complimentary treatment for appearing in this video.”

If your injector or front-desk lead had a treatment and wants to talk about it on camera, that can work too. Just say who they are on screen.

How do these rules change the shoot day?

Most compliance guides stop at the form. The rules also shape what happens on set and in the edit. Here’s how Aktion’s Plan / Roll / Cut process handles a testimonial shoot.

Stage	What happens for compliance
Plan Before the date	Authorization signed and copied; name scope agreed (full, first, none); channels and expiration written in; any thank-you credit decided and logged; interview questions sent ahead
Roll On the day	Charts, schedules, and screens out of frame; other clients kept out of the lobby and b-roll; questions focused on experience; no prompting for results or words
Cut The edit	No edits that change the meaning; disclosures on screen and spoken where needed; captions checked for names and details the client didn’t approve; each version tagged by channel and expiration date

The tagging step pays off later. Under 164.508(b)(5), a client can revoke an authorization in writing at any time (revocation doesn’t undo uses you already made in reliance on it). If you know exactly which ad, Reel, and web page each clip is on, a takedown takes minutes instead of an afternoon of searching.

What should you ask a client on camera?

Ask about the experience, not the outcome. Experience questions produce warmer answers, they’re easier to defend under the FTC’s typicality rule, and they keep you clear of the Florida Board of Medicine rule against advertising that “creates false or unjustified expectations of beneficial assistance” (Fla. Admin. Code R. 64B8-11.001). These work well:

1. What made you start looking into this treatment?
2. What were you nervous about before your first visit?
3. How did you choose this clinic?
4. What happened in your consultation? Did anything surprise you?
5. How did the staff make you feel during the appointment?
6. What would you tell a friend who’s thinking about booking?

Leave out “How much did it change your life?” and “What results did you get?” If a client volunteers a strong result claim (“it took ten years off”), don’t use that line unless it reflects what clients generally experience and you can support it. Before-and-after footage has its own rules, covered in our guide to before-and-after videos for med spas.

Keep the interview to about 20 minutes. Most clients relax after the first two questions, and the best lines usually come in the middle. Finished testimonials run well at 60 to 90 seconds for your website, with 15- to 30-second cuts for Reels and ads.

Testimonial checklist

• Before you film: separate authorization signed, with channels, name scope, and expiration; any credit decided and the same for everyone; questions sent ahead; room cleared of charts and other clients.
• Before you post: meaning unchanged by the edit; result claims either typical or qualified; material connections disclosed on screen and in the caption; staff relationships disclosed; nothing AI-generated or acted presented as a real client.
• If a client revokes: remove the clip from every channel on your tag list, stop new uses, and file the written revocation with the authorization.

Frequently asked questions

Is a treatment consent form enough to use a client in a video?

No. Treatment consent covers the procedure, not marketing. Under 45 CFR 164.508, a marketing authorization generally can’t be combined with other documents, and it needs its own elements: what’s used, where, for what purpose, an expiration, and the right to revoke. Get a separate signature for every client who appears.

Does HIPAA apply to a cash-only med spa?

It may not. HIPAA covers providers that conduct certain health care transactions electronically, such as insurance billing. But Florida’s likeness statute (540.08) and patient-records law (456.057) still apply, and so do the FTC’s rules. Use a HIPAA-grade authorization anyway and confirm your status with a compliance advisor.

Can we use actors or AI avatars for testimonials?

Only if the video clearly says they aren’t real clients. The FTC’s Endorsement Guides require that people presented as actual clients be actual clients in both the audio and video. The 2024 Consumer Review Rule makes fake testimonials a violation, and the FTC has said AI-generated reviews are covered.

Can we reuse a client’s Google review in a video or ad?

Not automatically. A public review isn’t permission to put it in your advertising. For a covered entity, quoting a client’s review in marketing still calls for an authorization, and Florida’s likeness statute applies if you show their name or photo. Ask the client and get it in writing.

What happens if a client wants their video taken down?

Take it down. Under the Privacy Rule, clients can revoke an authorization in writing at any time; revocation stops future uses but doesn’t undo uses you already made in reliance on it. Tag every clip by channel when you publish so you can remove all of them quickly.

Planning a testimonial shoot?

Aktion films med spa testimonials in Orlando and across Central Florida with consent handled in the Plan phase, not on the day. You bring the clients and your compliance contact; we bring the questions, the crew, and an edit with every version tagged by channel. Book a shoot and we’ll scope it with you.

Sources

• HIPAA Privacy Rule, 45 CFR 164.508, Uses and disclosures for which an authorization is required
• Federal Trade Commission, Guides Concerning the Use of Endorsements and Testimonials in Advertising, 16 CFR Part 255
• Federal Trade Commission, Rule on the Use of Consumer Reviews and Testimonials, 16 CFR Part 465, and the final rule notice, 89 FR 68034 (Aug. 22, 2024)
• Florida Statutes, 540.08, Unauthorized publication of name or likeness, and 456.057, Ownership and control of patient records
• Florida Board of Medicine, Fla. Admin. Code R. 64B8-11.001, Advertising
• Spiegel Research Center, Northwestern University, How Online Reviews Influence Sales

Related guides

• Med spa video production: a guide for aesthetic clinics
• Before-and-after videos for med spas
• Provider introduction videos for med spas
• Med spa video ideas: 10 videos worth filming