Card-Not-Present Payments for Med Spas: What Processors Review

Card-not-present payments may be available to med spas, but the acquirer or payment processor decides based on the actual services, authorization method, marketing, refunds, recurring billing, data flows, transaction history, and states served. Federal sources do not create a single med-spa payment rule; HIPAA, FTC, state, and contractual requirements remain separate reviews.

Card not present payments med spa at a glance

Are card-not-present payments legal for med spas?

Yes, the federal sources reviewed do not establish a blanket prohibition on card-not-present payments for med spas. Acceptance still depends on what is sold, how the customer authorizes payment, what information is collected, which states are involved, and whether the submitted model matches the provider’s approval.

A card-present transaction occurs through an in-person terminal. A card-not-present transaction occurs when the card is not physically presented, such as through hosted checkout, an invoice, a payment link, a telephone interface, or recurring billing. The distinction describes transaction handling; it does not determine whether the underlying service is lawful.

Separate state review may address medical practice, telehealth, automatic renewal, consumer privacy, breach notification, advertising, surcharges, convenience fees, and payment-method disclosures. No state-specific rule should be generalized without checking an official state source.

How do processors evaluate a med spa payment application?

The processor or acquirer decides whether to approve the submitted model, based on its underwriting and contractual requirements. Approval is not guaranteed, and the approved activity may not include later-added memberships, remote consultations, products, or medication-related services.

Prepare a consistent description of:

• Each service and charge, including deposits, prepaid packages, memberships, and balances.
• When payment is collected and when the service is delivered.
• Expected refunds, cancellations, disputes, and fulfillment timelines.
• Website, advertising, social-media, affiliate, booking, and checkout content.
• Recurring-billing terms and authorization controls.
• Any clinician, pharmacy, fulfillment, or clinical-organization relationship.
• States where patients are located or services are offered.

Do not route unrelated transactions through an approved account or omit material business activity. How Underwriters Evaluate a Telehealth Website Before Approving Payments explains why customer-facing content and the submitted business description need to align.

What rules apply to recurring billing for a med spa?

Yes, a med spa may evaluate recurring billing, but automatic or continuity charges require consumer authorization and must not be imposed without express consent. FTC guidance addresses payments and billing, while the status of the amended Negative Option Rule, 16 C.F.R. Part 425, requires current verification before describing its amended provisions as an unqualified mandate.

Use these baseline controls regardless of that unsettled status:

1. 1State the amount, frequency, renewal terms, minimum commitment, included services, and cancellation method before collecting card information.
2. 2Obtain separate affirmative authorization for the recurring feature.
3. 3Retain the authorization, disclosure version, timestamp, receipts, and cancellation history.
4. 4Make cancellation at least as accessible as enrollment and stop future charges promptly.
5. 5Provide written confirmation of cancellation and maintain refund records.

State automatic-renewal or membership laws may add notice, reminder, acknowledgment, refund, or cancellation requirements. Telehealth Subscription Payments: Recurring Billing, Refills, and Chargebacks provides related operational context without replacing state review.

What health-data issues should a med spa check before taking remote payments?

First determine whether the med spa is a HIPAA covered entity and which vendors create, receive, maintain, or transmit protected health information. A payment workflow may involve a booking system, hosted checkout, CRM, patient portal, analytics tool, accounting system, or text-payment service.

HIPAA Privacy, Security, and Breach Notification Rules include 45 C.F.R. § 164.502, 45 C.F.R. Part 164, Subpart C, and 45 C.F.R. §§ 164.400–414. HHS states that covered entities and business associates must notify affected individuals after a breach of unsecured protected health information, generally without unreasonable delay and no later than 60 days after discovery. Breaches affecting 500 or more individuals must also be reported to the Secretary within that period; smaller breaches are generally reported within 60 days after the end of the calendar year in which discovered.

A financial institution processing payment-card transactions in its ordinary banking role generally does not become a business associate merely because it facilitates payment. That does not decide the status of every payment, booking, CRM, or technology vendor. Review each vendor’s role, data access, storage, contract, and security controls.

The FTC Health Breach Notification Rule, 16 C.F.R. Part 318, may also apply to certain health-data businesses outside HIPAA. Its amendments became effective July 29, 2024. The rule can address unauthorized acquisition or disclosure of unsecured identifiable health information. For breaches involving 500 or more individuals, FTC notice is due at the same time as consumer notification, without unreasonable delay and no later than 60 calendar days after discovery.

Minimize treatment details, diagnoses, procedure names, or medication information in payment descriptors, receipts, invoices, emails, and text messages. Prefer hosted payment pages, tokenization, and processor-managed card storage where practical. FTC security guidance recommends collecting only needed information, limiting retention, using secure transmission, encrypting sensitive data in transit and at rest, restricting access, and reviewing third-party applications.

What advertising and testimonial issues affect med spa checkout?

Yes, advertising and testimonial claims can affect both consumer-protection exposure and underwriting review. Under the FTC Guides Concerning the Use of Endorsements and Testimonials in Advertising, 16 C.F.R. Part 255, advertisers are responsible for claims communicated through endorsements and testimonials; claims must not be deceptive or unsupported, and material connections may require disclosure.

The FTC Trade Regulation Rule on the Use of Consumer Reviews and Testimonials, 16 C.F.R. Part 465, became effective October 21, 2024. It addresses fake or false reviews, testimonials from people who did not use the service, buying or selling reviews, incentives conditioned on sentiment, certain undisclosed insider reviews, and deceptive review suppression.

Review claims on landing pages, payment pages, social media, booking portals, text-message links, and checkout flows—not only the main website. Avoid guarantees or unsupported outcome claims, document real patient experiences, disclose compensated or insider relationships, and do not condition incentives on positive reviews. State medical-board and consumer-protection rules may be stricter.

What changed recently?

The following developments were checked against official sources as of September 15, 2026:

• July 29, 2024: FTC amendments to the Health Breach Notification Rule became effective.
• October 21, 2024: FTC Consumer Reviews and Testimonials Rule became effective.
• January 14, 2025: The amended Negative Option Rule was stated to become effective, with most substantive provisions initially assigned a May 14, 2025 compliance date.
• May 2025: Later FTC materials referred to the amended Negative Option Rule as the “Vacated Rule.” Confirm current status before making a definitive legal statement.
• February 13, 2026: HHS updated its official breach-reporting instructions page.

What do I do before applying for med spa card-not-present processing?

1. 1Founder: Inventory every charge, service, sales channel, delivery timeline, refund situation, and recurring authorization.
2. 2Founder and platform: Map data from intake or booking through checkout, receipts, accounting, CRM, portals, analytics, and storage.
3. 3Counsel or privacy lead: Assess HIPAA covered-entity and business-associate roles, state requirements, and breach procedures.
4. 4Founder and marketing team: Review claims, testimonials, reviews, cancellation language, refund terms, and payment-page disclosures.
5. 5Founder: Identify every clinician, clinical organization, pharmacy, or fulfillment entity and describe its role accurately.
6. 6Processor or acquirer: Submit the actual website, services, transaction flow, states served, expected activity, and supporting documents.
7. 7Acquirer: Confirm in writing which activities, channels, recurring charges, and transaction descriptions are approved.
8. 8Founder and platform: Re-review the model before adding new services, products, memberships, remote encounters, or medication-related activity.

MDLaunchr, the brand behind WhiteLabelClinic.com, is a platform—not a processor or regulator—that helps qualified businesses evaluate and coordinate technology, operational, compliance, clinical-network, and fulfillment relationships. What Documents Do Telehealth Merchant Account Underwriters Require? may help organize an underwriting file. Explore how MDLaunchr and WhiteLabelClinic.com can support a compliance-first telehealth launch.

Questions to ask your processor

• “Is my specific med spa service mix approved for card-not-present transactions?”
• “Which website pages, sales channels, payment descriptors, and transaction types are included in approval?”
• “Are deposits, prepaid packages, memberships, recurring charges, or remote consultations treated differently?”
• “What current fees, reserves, monitoring thresholds, dispute requirements, and restrictions apply to this account?”
• “What documents do you require to verify ownership, services, refunds, fulfillment, and clinical relationships?”
• “How should payment, appointment, and health information be separated in your hosted checkout and receipts?”
• “What written approval is required before adding a new service, state, sales channel, or medication-related activity?”

Is a card-not-present payment the same as a card-present payment?

No. Card-not-present means the card is not physically presented, while card-present generally uses an in-person terminal. The distinction concerns transaction authorization and processing, not whether the med spa’s service or business model is lawful.

Can a med spa use recurring memberships?

Yes, but recurring charges require clear terms, affirmative authorization, accessible cancellation, accurate receipts, and appropriate refund controls. State automatic-renewal or membership laws may impose additional requirements.

Does processor approval prove HIPAA compliance?

No. Processor approval is a private underwriting decision. It does not establish compliance with HIPAA, the FTC Health Breach Notification Rule, advertising rules, medical-practice requirements, or state privacy law.

Does a payment processor automatically become a HIPAA business associate?

Not necessarily. HHS explains that a financial institution processing payment-card transactions in its ordinary banking role generally is not a business associate merely because it facilitates payment. Other vendors may qualify based on their role and access to protected health information.

Is a med spa an online pharmacy if it accepts payment remotely?

No, not automatically. Classification depends on the business’s activities and representations. Selling or shipping prescription medication or coordinating fulfillment can create additional clinical, pharmacy, and state-law questions requiring separate review.

Are card-network fees, reserves, and thresholds the same for every med spa?

No. The approved sources do not provide current fees, reserve requirements, chargeback thresholds, prohibited-business classifications, or underwriting thresholds. Confirm those terms directly with the acquirer; they are not guaranteed here.

Related reading: the full guide this article belongs to.