Med Spa AI Receptionist: Treatment Names It Gets Wrong

This guide is for the product team that runs a med spa AI receptionist inside spa or med spa booking software. Your agent answers calls for hundreds of clinics. Each clinic has its own menu, injectors and policies. A salon agent that books the wrong color service wastes an hour. A med spa agent that books the wrong treatment sends a caller to the wrong provider, with the wrong product prepared, sometimes without a required consult.

Vendor lists of the best AI receptionist for med spas compare features. None show how to test treatment names. Boulevard, which builds booking software for salons, spas and med spas, is hiring a Senior Product Manager for its AI Receptionist. The role covers "client communication across voice and text" and deciding "when it hands off to staff." That handoff line is where most med spa risk lives.

If you run a general salon agent, start with our AI receptionist for salons and spas QA playbook. For hair-service mapping errors, see why balayage becomes the wrong appointment. This post covers what is different once treatments are medical.

Why a med spa booking is not a salon booking

In a salon, the service name sets the time and the stylist. In a med spa, the service name sets much more. It decides who may legally perform it, whether a consult must come first, which product gets prepared, and what pre-care text goes out.

Med spa AI receptionist: a voice agent that answers a medical spa's phone, books aesthetic treatments into the clinic's booking system, and hands clinical questions to licensed staff.

A med spa answering service staffed by people learns these rules in training. A medical spa voice agent gets them only from data. Each treatment family sets its own booking fields, with values set per clinic.

When the agent gets the treatment wrong, all four go wrong at once. Nothing errors, because each value is valid for the wrong service.

Why does AI mishear treatment names?

Treatment names are rare words, often brand names that speech models rarely saw. Phone audio makes it worse. Most calls arrive as 8 kHz μ-law, so the high-frequency cues that separate "Dysport" from "this port" are gone.

Three research results explain the pattern.

• Rare words fail first. Fox and Delworth (2022) found end-to-end ASR models "struggle with" rare and unseen words. Standard shallow-fusion biasing did not fully fix it. Their alternate-spelling model raised rare-word recall by 34.7% relative, and out-of-vocabulary recall by 97.2%.
• Biasing works, with trade-offs. Huber and Waibel (2026) compared context biasing with speech LLMs. Biasing cut WER on the biased words by up to 88% relative and left other words largely unaffected. Speech LLMs did well on read speech but generalized less well to spontaneous speech. They were also sensitive to distractor words and word order in the prompt.
• Low WER can hide entity errors. Afonja et al. (2024) tested ASR on clinical English across 93 accents. Some models had low overall WER but more errors on drug names and other clinical entities. Fine-tuning cut medical WER by 25 to 34% relative.

The third point matters most for your dashboards. A WER of 6% says nothing about whether "Dysport" survived. Track entity accuracy on treatment names separately, as in our guide to STT entity accuracy.

The language model makes it silent

ASR errors are only half the story. The LLM then "repairs" the transcript toward the nearest catalog item. "This port forty units" has a number and the word "units," so the model may guess neurotoxin and get lucky. "Lip flip" is a real neurotoxin treatment. It sits one word away from "lip filler," a different product, provider pool and price. A model that pattern-matches on "lip" plus a service name picks filler and sounds confident.

Numbers drift too. "Fifteen" and "fifty" differ by one syllable. "Two" means syringes for filler but is a likely error for neurotoxin units, so the agent should ask.

Bias the ASR and resolve in code

Treat the clinic's service catalog as the single source for both ASR biasing and service resolution. Deepgram's keyterm prompting supports Nova-3 and Flux, as of October 2026. You repeat the `keyterm` parameter once per term. The limit is 500 tokens across all keyterms, and the docs suggest "the most important 20-50 terms." One gotcha: a malformed value "silently boosts nothing instead of failing." Another: an over-limit mid-stream `Configure` update can stop Nova-3 transcription without an error.

# Simplified sketch: one tenant catalog drives ASR biasing and service resolution.
from urllib.parse import urlencode

CATALOG = {
    "neurotoxin": {
        "synonyms": ["botox", "dysport", "xeomin", "tox", "baby botox",
                     "lip flip", "elevens", "crow's feet", "forehead lines"],
        "count_unit": "units", "consult_if_new": True, "credential": "toxin_injector"},
    "dermal_filler": {
        "synonyms": ["filler", "juvederm", "restylane", "lip filler",
                     "cheek filler", "under-eye filler"],
        "count_unit": "syringes", "consult_if_new": True, "credential": "filler_injector"},
}
KEYTERMS = ["Botox", "Dysport", "Xeomin", "Juvederm", "Restylane",
            "lip flip", "microneedling", "IPL"]  # proper nouns capitalized, per docs

def listen_url(keyterms: list[str]) -> str:
    params = [("model", "nova-3"), ("encoding", "mulaw"), ("sample_rate", "8000")]
    params += [("keyterm", k) for k in keyterms]  # one param per term, no commas
    return "wss://api.deepgram.com/v1/listen?" + urlencode(params)

def resolve(utterance: str) -> dict:
    text = utterance.lower()
    hits = {svc for svc, c in CATALOG.items() for s in c["synonyms"] if s in text}
    if len(hits) != 1:  # zero or two families heard: never guess
        return {"action": "clarify", "candidates": sorted(hits)}
    svc = hits.pop()
    return {"action": "read_back", "service": svc,
            "count_unit": CATALOG[svc]["count_unit"]}

Code, not the model, writes the service ID. When two families match, or none, the agent asks. Then it reads back the treatment, the area and the count in the right unit before it books.

What a wrong treatment breaks downstream

The call is the front door to a workflow. The agent captures the request, writes a booking, triggers a deposit, and sends pre-care text. Later a provider opens the chart and preps product. A wrong service ID moves through every step.

Here is a worked example with illustrative numbers. Suppose your platform handles 40,000 injectable booking calls a month across all clinics. Suppose 1.5% end with the wrong treatment family. That is 600 wrong bookings a month. If half are caught at check-in and cost 20 minutes of rework, that is 100 front-desk hours. The other half reach the treatment room with the wrong product or provider. No dashboard shows any of them, because every booking was "successful."

Check the record, not the conversation. Our guide to tool argument accuracy covers assertion patterns for the booking payload.

Who can inject neurotoxins at a med spa?

The answer depends on the state, and sometimes on the product. Alabama is one strict example. The Alabama Board of Medical Examiners' cosmetic botulinum toxin protocol form lets a nurse practitioner or physician assistant inject only under an approved protocol. The supervising physician must "remain on-site at all times." The form also says injections "cannot be performed in a non-medical setting." Other states allow registered nurses to inject under different supervision rules.

Filler carries its own risk profile. The FDA describes dermal fillers as "medical device implants". It names unintentional injection into a blood vessel as a key risk. It advises patients to choose "a licensed health care provider" with relevant experience.

Your agent should never reason about any of this. It should not know state law. It should read a credential tag on each provider, set by the clinic, and a required-credential tag on each service. Code filters the bookable slots. A booking for a neurotoxin can only land on a provider tagged for it. The same applies to consult rules. If the clinic requires a consultation before a first filler, code blocks the treatment slot and offers a consult slot instead.

Test this as routing. Build cases where the only open slot belongs to a provider without the right credential. The pass condition is "no booking, offer another time or a consult." Our guide to escalation and handoff accuracy covers how to score these.

Should an AI receptionist answer medical questions?

No. Med spa callers ask clinical questions mid-booking all the time. "Is it safe while I'm pregnant?" "I'm on blood thinners, is that a problem?" "Can I do filler the same day as my peel?" Each one is a contraindication question. A licensed clinician must answer it.

The research shows why "the model knows the answer" is not enough. Bean et al. (2025) ran a study with 1,298 members of the public. LLMs alone identified conditions in 94.9% of cases. People using those LLMs identified relevant conditions in under 34.5% of cases. They did no better than a control group. The interaction, not the knowledge, broke.

The refusal rule has three parts:

1. Detect the question, even when it is buried in a booking turn.

2. Decline without hinting at an answer. "That's a question for our clinical team" is fine. "It's usually fine, but check with them" is a fail.

3. Route it: a callback task tagged clinical, or a live transfer if the clinic offers one. The booking can continue if the caller wants.

Some calls are urgent. A caller describing vision changes or worrying skin changes after filler needs the clinic's urgent path at once. The FDA lists vision problems among filler risks. The agent's only job is to recognize the pattern and escalate. It must not reassure.

Pre-care instructions are the gray zone. The agent may read them, but only the clinic's approved text for that exact service, word for word. If the service ID is wrong, the pre-care is wrong too. Our guardrail testing guide shows how to build pressure variants.

Can an AI receptionist take deposits for med spa appointments?

Yes, if the booking platform already has a payment flow the agent can trigger. Most teams send a secure payment link by text rather than taking card numbers by voice. That keeps card data out of transcripts and recordings. The deposit amount must come from the clinic's rule for the resolved service, never from the model.

Packages and memberships are harder. A caller asks, "How many sessions do I have left?" The agent must read the ledger and speak the value with its label. It must not do arithmetic on what the caller says. Test three ledger states:

• A package with sessions remaining, plus one session booked but not yet redeemed.
• A membership with banked credit that expires at month end.
• A package bought at one location, asked about at a sister location.

The common bug is counting a booked session as used, or not. Either way, the caller hears a wrong package balance. Assert the spoken number against the ledger API response in the same call.

Is a med spa covered by HIPAA?

Sometimes. HHS says a health care provider is a covered entity "only if" it transmits health information electronically "in connection with a transaction for which HHS has adopted a standard." Those are mainly insurance transactions. A cash-pay med spa that never bills insurance electronically may fall outside HIPAA. A med spa inside a dermatology practice that bills insurance may be covered. Your tenants will include both.

Being outside HIPAA does not mean outside health privacy law. Washington's My Health My Data Act, says the state attorney general, protects "personal health data that falls outside the ambit" of HIPAA. A recording where a caller names a treatment and a medication is sensitive data either way.

Design for the strictest tenant. Restrict recordings and transcripts. Watch for the agent reading one client's treatment history to an unverified caller. Our PII leakage detection guide covers the test cases. For the wider healthcare picture, see voice agent testing for healthcare. This is not legal advice.

Do med spa reminder calls need TCPA consent?

Outbound reminders and offers fall under the TCPA. The FCC ruled in February 2024 (FCC 24-17) that AI-generated voices count as an "artificial or prerecorded voice," as Wilson Sonsini summarizes. So an AI reminder call to a mobile number needs prior express consent under 47 CFR 64.1200(a)(1)(iii).

Three med spa specifics follow from the rule text:

• Offers are telemarketing. "20% off filler this month" needs prior express written consent under 64.1200(a)(2). An appointment reminder that drifts into an upsell changes category mid-call.
• The health care exemption is narrow. Section 64.1200(a)(3)(v) covers health care messages "made by, or on behalf of, a 'covered entity'" under 45 CFR 160.103. A med spa that is not a HIPAA covered entity cannot rely on it.
• Opt-out rules just changed. The FCC adopted an order (FCC 26-67) on September 30, released October 1, 2026, that narrows "revoke-all" for informational calls and lets businesses name exclusive opt-out methods. See Kelley Drye and Nixon Peabody. It takes effect 30 days after Federal Register publication, which had not happened as of early October 2026.

Test that a reminder script never adds an offer, and that "stop calling me" is recorded against the right consent category. Our appointment reminder evaluation guide has the full checklist. This is not legal advice.

How to test a med spa AI receptionist before every release

How do you test a med spa AI receptionist? Test every release against the stored record, across caller conditions, for each tenant catalog. These steps assume one shared agent handles aesthetic clinic phone booking for many clinics.

1. Build synonym sets from each catalog. For every service, list brand names, slang, areas and misspellings. Include confusable pairs: lip flip and lip filler, "BBL" as a light treatment and as a surgery, microneedling with and without add-ons.

2. Generate scenarios from the prompt and flows. Cover new versus returning clients, consult-required services, deposits and package redemption. Evalgent generates test scenarios from an agent's prompt and flows, including branches, policies and coverage gaps.

3. Vary the caller. Run each scenario with accents, fast speech, interruptions, and background noise from a car or a busy room. Include Spanish callers if your clinics serve them. See synthetic callers for voice agent testing.

4. Call over the real phone path. ASR on 8 kHz μ-law behaves differently from a browser demo. Evalgent's simulator reaches the agent over PSTN, SIP or WebRTC.

5. Assert on the booking payload. Check service ID, area, count and unit, provider credential, consult flag, deposit amount and pre-care template ID. A polite call with a wrong field is a fail.

6. Run credential and consult routing cases. Offer only slots from uncredentialed providers. The pass result is no booking and an alternative.

7. Run the medical-question suite. Direct, indirect, mid-booking and repeated-pressure variants. Zero tolerance: any clinical answer is a fail.

8. Size the run count. With zero failures in n runs, the 95% upper bound on the failure rate is about 3/n (the rule of three). For zero-tolerance cells, 300 clean runs bound the rate under 1%.

9. Gate the release. One failing tenant catalog blocks the deploy. Our guide to shipping prompt changes safely covers canary patterns.

Judge from the audio, not only the transcript. A transcript that reads "lip flip" can come from audio the agent actually heard as "lip fill." Evalgent scores calls from the audio, with an LLM and Jev judge that cites evidence, plus human review of verdicts.

Monitoring live calls across many clinics

Live calls cover the cases you did not think of. A new clinic adds a treatment your synonym list lacks. A new injector joins without a credential tag. A medspa AI receptionist that passed last month can fail this month.

Score every call, not a sample, as argued in score every call, not a sample. Four production checks catch most med spa failures:

• Treatment mismatch. The treatment named in the audio differs from the service ID stored.
• Clinical answer given. Any turn where the agent answered a contraindication question.
• Credential mismatch. A booking where the provider lacks the service's required tag.
• Balance mismatch. A spoken package balance that differs from the ledger read.

Slice every metric by tenant. A 0.5% platform-wide error rate can hide one clinic at 8%. Our multi-tenant testing guide explains how to set per-tenant thresholds. Evalgent's production monitoring takes pushed call recordings, maps them to scenarios, and flags policy failures, tool-call failures and PII leakage with fix recommendations.

Frequently asked questions

Can an AI receptionist book Botox and filler appointments?

An AI receptionist can book neurotoxin and filler appointments if code, not the model, resolves the service. The agent should read back treatment, area and count before booking. It must apply the clinic's consult rule for new clients and book only providers tagged for that service. It should never answer clinical questions while booking.

Why does AI mishear treatment names?

Treatment names are rare brand words, and phone audio is 8 kHz, which removes acoustic detail. ASR swaps them for common words, like "this port" for Dysport. The language model then guesses the nearest catalog item. Keyterm biasing, catalog-based resolution and a spoken read-back of treatment, area and count reduce these errors.

Who can inject neurotoxins at a med spa?

Injector rules for neurotoxins vary by state. Alabama, for example, allows nurse practitioners and physician assistants to inject only under a board-approved protocol, with the supervising physician on site. Other states allow registered nurses under different supervision. A voice agent should never decide this. It should book only providers whose credential tags match the service.

Should an AI receptionist answer medical questions?

An AI receptionist should not answer medical questions about pregnancy, medications, side effects or combining treatments. It should decline without hinting at an answer, then route the question to licensed clinical staff. Possible urgent symptoms after filler, such as vision changes, must trigger the clinic's urgent escalation path at once.

Can an AI receptionist take deposits for med spa appointments?

An AI receptionist can trigger deposits when the booking platform has a payment flow, usually a secure text link. The deposit amount should come from the clinic's rule for the resolved service. Card numbers should stay out of the voice channel, transcripts and recordings. Test that a wrong treatment never produces the wrong deposit.

Is a med spa covered by HIPAA?

A med spa is a HIPAA covered entity only if it transmits health information electronically in standard transactions, mainly insurance billing. Many cash-pay med spas are not covered. Some, such as those inside a billing dermatology practice, are. State laws like Washington's My Health My Data Act can still apply. This is not legal advice.

Do med spa reminder calls need TCPA consent?

Med spa reminder calls using an AI voice need prior express consent to mobile numbers, since the FCC treats AI voices as artificial. Promotional offers need prior express written consent. The TCPA health care message exemption applies only to HIPAA covered entities. FCC 26-67 changes opt-out handling once effective. This is not legal advice.

How do you test a med spa AI receptionist?

Test a med spa AI receptionist with synonym sets per clinic catalog, confusable pairs, and varied caller accents and noise. Call over the real phone path. Assert on the stored booking: service, area, units, provider credential, consult flag and deposit. Add a zero-tolerance medical-question suite. Then monitor every live call by tenant.

The bottom line

A med spa AI receptionist is only as safe as the service ID it writes. Test the stored booking, the provider credential and the clinical handoff on every release, then score every live call by clinic.