Med spa software in Baltimore: in Maryland the prescriber has to be in the building, and a unit of Botox is not a unit of Dysport

Picture three practices in the Baltimore area with a busy season ahead. The first is a nurse practitioner who owns a two-room med spa above a shop on a Canton commercial street, with a registered nurse who injects three afternoons a week. The website takes bookings around the clock, and on a Tuesday night a new patient books “Botox, 30 minutes” with the nurse for Thursday at four. Maryland’s Board of Nursing does not allow that appointment to happen as booked. The nurse may inject only on a written order for that patient from a prescriber who has assessed the patient, and the prescriber must be physically present in the setting while the nurse treats. If the nurse practitioner has a school pickup at four, the Thursday slot should never have been offered.

The second is a dermatology group in Towson with an aesthetics arm, a physician assistant and a newly hired esthetician the group hoped would take over laser hair removal. Maryland does not allow that either. Maryland law since 2024, and the Board of Cosmetologists’ regulations since March 2026, let an esthetician perform cosmetic microneedling with needles no longer than one millimeter, but no lasers, no IPL, no radio frequency and no injections, and the Board of Physicians’ cosmetic rules do not let a physician hand those procedures to anyone who is not licensed under the Health Occupations Article. The group also sells tretinoin and Latisse to its patients and has asked us about shipping them. A Maryland physician who dispenses prescription drugs needs a permit, renewed every five years, and the permit forbids dispensing by mail order.

The third is a wellness clinic in Owings Mills that injects toxin, runs IV drips and wants to sell a monthly weight-loss membership online. Compounded semaglutide was the obvious product in 2024. Since 2025 it has been off the FDA’s shortage list, the agency has proposed keeping it off the list outsourcing facilities may compound from, and the manufacturers now sell the approved drugs directly to patients, the Wegovy pill from $149 a month. The drips have a four-hour clock under the sterile-compounding standard, and the membership is subject to Maryland’s automatic-renewal law and possibly to its health club law, which names “weight reduction center” in its definition.

Each of them has a software problem dressed as a compliance problem. The rules ask who assessed the patient and when, who wrote the order and whether they are in the building, which license may perform which service at which needle depth or energy, which brand a unit belongs to, which vial went into which patient, which product may be put in a cart and which must go through a pharmacy, how long each record and consent must be kept, and what a “free consultation” is allowed to lead to. Every one of those questions is answered, or not, by the way a practice books, charts and sells, and the answers have to exist before a board investigator, a patient or a card network asks for them. This article goes through those questions for Baltimore City and Baltimore County, using Maryland’s statutes and regulations, the FDA labels, federal enforcement records, the trade’s own data and our census of 52 local med spa websites, and it sets out what the software costs. It covers the online store and the booking page in detail, because that is where the rules have to work without a person checking. It is our reading of the rules for the products we build, not legal or medical advice.

What Baltimore’s med spa trade looks like

There is no official count of med spas, in Baltimore or anywhere else. The Census Bureau has no industry code for them, so a med spa is filed as a physician’s office, a nurse practitioner’s practice, a beauty salon or a personal-care business depending on who owns it and how it describes its business, and the Bureau’s County Business Patterns counts only businesses with paid employees. The best national number comes from the trade association. The American Med Spa Association’s most recent State of the Industry report, published in 2024 with data for 2023, counted 10,488 med spas in the United States, up from 8,899 a year earlier, with average revenue of $1,398,833. Eighty-one percent have a single location. The average one sees 245 patient visits a month at $527 a visit, and 73% of its patients are repeat patients, which is why memberships, packages and rebooking reminders matter so much to this trade’s software. The association surveys every two years, and it has not yet published a report from its 2026 survey.

Two of the association’s numbers explain a lot about the rules that follow. Sixty-seven percent of single-owner practices are owned by someone other than a physician or surgeon, and nurse practitioners have nearly drawn level with physicians as owners. And 74% of medical directors come from outside the four specialties most associated with aesthetics: plastic surgery, facial plastic surgery, oculoplastic surgery and dermatology. In Maryland, that ownership pattern runs straight into the question of who must be in the building, which is the subject of the next sections.

Applied to Baltimore, the national density gives a rough check on our own count. The country has about one med spa for every 32,000 residents; Baltimore City and Baltimore County together have about 1.42 million, according to the Census Bureau (569,997 in the City and 847,650 in the County, in the Bureau’s July 2025 estimates), which works out to about 44. Using the higher national estimate of 13,000 med spas that circulated in 2026 gives about 54. Our own census, described below, found 59 locations belonging to 56 businesses, ten of them in the City, so Baltimore looks like an ordinary American market for this trade, slightly better supplied than the national average and heavily concentrated in the County, in Lutherville-Timonium, Towson, Owings Mills, Hunt Valley and around White Marsh. If those practices earn something like the national average, and that is an assumption we cannot check, the local trade takes in somewhere between $65 million and $83 million a year.

Demand has been steady rather than explosive. The American Society of Plastic Surgeons estimated 9,883,711 neuromodulator injections in 2024, 4% more than in 2023, alongside 5,331,426 hyaluronic acid filler treatments and 3,112,056 laser skin treatments, and for the first time it counted “prescribed weight loss medication,” at 837,485. Its 2025 report gives only shares, with neuromodulators making up half of all minimally invasive treatments. Weight-loss drugs have arrived in this trade from the other direction. In KFF’s November 2025 poll, 18% of American adults said they had ever taken a GLP-1 drug and 12% were taking one; of those who had ever taken one, 9% said they got it from “a medical spa or aesthetic medical center,” and 17% online.

The manufacturers run software, too

The single most important product in a med spa is made by a company that also runs the trade’s largest loyalty program, and in 2025 changes to that program helped cut the product’s U.S. revenue by double digits. AbbVie’s annual report says U.S. net revenue from Botox Cosmetic fell 11% in 2025, from $1,682 million to $1,504 million, “primarily driven by unfavorable pricing due to customer loyalty program changes,” along with lower market share and weaker demand. In the first half of 2026 it grew 9%, partly because those changes were now a year old. AbbVie says its Allē program has eight million members across 30,000 U.S. practices; Evolus, which makes Jeuveau, says its own rewards program has more than 1.5 million members. A patient who walks into a Towson med spa may carry two manufacturers’ loyalty accounts, a manufacturer-issued gift card and the practice’s own membership, and the practice’s software has to keep them apart.

Manufacturers’ software can also disappear. Revance, the maker of Daxxify, launched a payments and commerce platform for aesthetic practices called OPUL; its 2024 quarterly report says payment processing for its customers ended on January 31, 2024, and Revance itself was bought by Crown Laboratories in February 2025. A few years is a short life for the system that holds a practice’s payment history, which is a good argument for owning, or at least being able to export, your own records.

What the software costs, and what the meter counts

I start every one of these articles with the vendors’ own price pages, read on the day of writing, because the prices that travel around the web are usually a year or two old. On October 22, 2026, the picture for med spa software was the familiar one for health care: the products built specifically for aesthetic practices mostly ask you to book a demo, and the ones that publish a price count different things.

Three things in that table are worth slowing down for. The first is the unit. Mangomint counts “anyone with a profile,” which in its own words includes “front desk employees,” so the receptionist who never touches a syringe is a seat. Jane counts practitioners and draws the line between part time and full time at 24 booked hours a week, which a part-time medical director rarely reaches. Boulevard counts locations and lets you add as many providers as you like. None of these is wrong, but a practice with one location, two injectors and three people at the front desk pays very differently under each, and the cheapest plan on the page is rarely the cheapest for you.

The second is the gap between the advertised price and the bill. Aesthetic Record’s $15 a user is unusually low for software built for aesthetic practices, and it comes with a $399 setup fee, an e-prescribing add-on priced per prescriber and payment processing whose card rates are not published. Boulevard’s pricing page opens on its salon plans, billed annually, so the number most people quote as “Boulevard’s price” is not the med spa price at all. And the payment rates that every one of these companies earns money on are, for most of them, not on the page.

The third, and the largest, is that the subscription is the small part. To see how small, we modeled a Baltimore practice with a part-time medical director, two nurse practitioners, two registered nurses, one of whom runs the lasers and skin treatments, and two people at the front desk, seeing about 3,000 active patients and taking in $1.6 million a year, 30% of it through monthly memberships, with $150,000 of skincare sales, a quarter of them online. Those inputs are our assumptions, not anyone’s actual books. On Aesthetic Record’s higher plan for seven users, the software costs $1,596 a year. Processing the same practice’s payments at Stripe’s published rates, with a sliver of patient financing at Cherry’s lowest advertised fee, costs about $44,800, roughly 2.8% of revenue. Put the same practice on Boulevard’s promotional bundle, RepeatMD for memberships and financing and a basic Shopify store, and the parts that can be priced from public pages add up to $25,613 before Boulevard’s own card processing, which it does not publish, and RepeatMD’s platform fee, which it describes only as “hundreds of dollars” a month.

How a card is charged moves the number, too. Square charges 2.6% + 15¢ for a card tapped at the front desk on its free plan, but 3.5% + 15¢ for a card kept on file and charged later, which is exactly how a no-show fee or a membership is collected. Stripe charges $15 when a patient disputes a charge and another $15 if you contest it, which is most of a $50 late-cancellation fee. A booking system that keeps the patient’s signed acceptance of the cancellation policy, with a timestamp, next to the card is not a nicety; it is the evidence you need to keep that $50.

Financing has its own meter. Cherry’s comparison page quotes merchant fees that “start at” 1.70% in one block and 1.90% in another. CareCredit, PatientFi and Alphaeon publish no merchant fees at all, and Affirm’s and Klarna’s U.S. business pricing pages returned 404 errors when we checked. RepeatMD passes part of its cost to the patient as that 2.5% service fee, so the price a patient sees in the app is not the price on your menu, and your front desk should be able to explain the difference. One more number is worth knowing: a telehealth good-faith exam, the remote assessment many med spas use before a first treatment, is sold by Qualiphy at $27.99 an exam with no monthly fee. Whether a remote exam satisfies Maryland’s rules is a separate question, which we come to below.

Two of the most important pieces of software in many med spas do not appear on a price list at all. Allē, AbbVie’s loyalty program, runs on the practice’s counter and in its patients’ phones, but its terms for practices sit behind a login, so what a practice gives up to take part is not something we could read. And the management-services companies that set up and run med spas for nurse practitioners and nurses, supplying the medical director, the software and the payment processing for a share of revenue, quote their fees privately; at the one whose pricing page we tried, the address returned a 404. Both arrangements can be sensible, and both are software you do not control, which matters more in this trade than in most, as the next sections show.

The part no national platform models: in Maryland, the prescriber sees the patient first

Most of what a med spa’s software has to know comes from one short chapter of Maryland regulations that very few booking tools have read. COMAR 10.32.09, the Board of Physicians’ rule on “Delegation and Assignment of Performance of Cosmetic Medical Procedures and Use of Cosmetic Medical Devices,” has been in force since August 23, 2010. It has nine regulations and fits on two printed pages. It governs any cosmetic medical procedure that a physician performs, delegates, assigns or supervises, and it defines both halves of the trade broadly. A “cosmetic medical device” is a device “that alters or damages living tissue,” which includes lasers, intense pulsed light, devices that emit radio frequency, electric pulses or sound waves, and “devices used for the injection or insertion of foreign or natural substances into the skin, fat, facial tissue, muscle, or bone.” A cosmetic medical procedure includes laser and light treatments, radio-frequency and microwave treatments, chemical peels that ablate living skin, dermabrasion, treatments meant to destroy fat and, in the words of the definition, “subcutaneous, intradermal, or intramuscular injections of medical products.” A syringe of neurotoxin, a syringe of filler, a hair-removal laser and a radio-frequency microneedling pen are all inside it.

The chapter then does something unusual for a regulation about medicine: it describes a workflow. Regulation .05 lists what the physician “shall” do when someone else performs the procedure, and every item on the list is a record or a rule a computer can check. The heart of it reads:

“A physician shall: … (2) Personally perform the initial assessment of each patient; (3) Prepare a written treatment plan for each patient, including diagnosis and planned course of treatment and specification of the device and device settings to be used; (4) Obtain informed consent of the patient to be treated by a non-physician; (5) Except as indicated in §B or C of this regulation, provide onsite supervision whenever a non-physician is performing cosmetic medical procedures or using cosmetic medical devices.”

The physician must also keep written office protocols for each procedure at each site, and the exceptions in §B and §C concern physician assistants, to whom we return below. On-site supervision is defined, too: the physician must be “present at the site” and “able to respond in person.”

What each sentence becomes in software

Read as a specification, the chapter produces five rules that a booking system built for salons does not have, because a salon never needed them.

The first is an ordering rule. A new patient cannot be booked straight into a delegated treatment, because the physician’s personal initial assessment has to come first, and the person doing the treatment must, under regulation .08, “verify that the physician has assessed the patient and given written treatment instructions for the procedure.” In software terms, the first appointment for a patient who has never been assessed is a different product from the second one, and the online booking page has to know which patient is which before it shows any slots. Some med spa websites handle this with a “new patient consultation” button; most leave it to the front desk to route people correctly. That works until a returning client books a laser package online for a friend.

The second is a resource rule. If a registered nurse or a physician assistant without a qualifying arrangement is performing the procedure, the physician has to be in the building for the whole of it. That makes the physician’s calendar a resource for every appointment that someone else performs. A 4:00 p.m. injection appointment with a nurse is bookable only if a physician will be on site from 4:00 until it ends, and when the medical director leaves at 3:30 on a Friday, every non-physician appointment after 3:30 has to disappear from the online calendar. Generic booking tools let you attach a room or a machine to a service. Requiring a second person to be present at the location, without booking that person into the appointment or blocking their own calendar, is a different kind of rule, and it is the one Maryland wrote.

The third is a document rule. The treatment plan must name “the device and device settings to be used,” and the protocols must include, for each piece of equipment, the manufacturer’s specifications, the operating instructions and a maintenance log, plus documentation of “initial and periodic training of all users of the equipment.” For a laser practice, that is three linked records: the device, its service history, and who has been trained on it. When the plan says a given laser at given settings, the chart for each session should record what was actually used, so a change from the plan is visible rather than buried in a note.

The fourth is a consent rule. Under .08, the non-physician must make sure the patient “is aware that the treatment will be provided by a non-physician” and “has given consent in writing to treatment by a non-physician.” That is a separate consent from the procedure consent most practices already collect, and it belongs to the patient-and-provider pairing rather than to the procedure: a patient who has only ever been treated by the physician has not given it.

The fifth is a checkout rule. The non-physician must “notify the delegating physician about any adverse events or complications before the patient leaves the site” and document them in the chart. A visit that ends with a bruise, a burn or a blanching area of skin cannot simply be closed at the front desk; the record should show that the physician was told, and when, before the patient walked out.

None of this is exotic. It is the same logic as a pharmacy that will not release a prescription until the pharmacist has checked it. But because Maryland wrote it into a regulation in 2010, and because the penalty for getting it wrong falls on the physician and on the person holding the syringe, it is the part of a med spa’s software that matters most and gets the least attention.

What getting it wrong costs

Regulation .09 is short. A physician may be disciplined for delegating or assigning a procedure to someone the chapter does not allow, for delegating to someone who has not had the required training, or for any failure to follow the chapter. A non-physician who violates it “is guilty of the practice of medicine without a license,” and so is anyone who performs a cosmetic medical procedure without authority under this chapter or under another health board’s regulations. The regulation mentions a fine of up to $50,000. The statute behind it, Health Occupations §14-606, says more: practicing medicine without a license is a felony, punishable by a fine of up to $10,000, up to five years in prison, or both, and separately by a civil fine of up to $50,000 levied by a disciplinary panel of the Board.

Nurses have their own rule, and it is stricter

The physicians’ chapter is only half the picture, because many injections in Maryland med spas are given by nurses, and nurses answer to the Board of Nursing. Its chapter on cosmetic procedures, COMAR 10.27.25, in force since May 30, 2011 and last amended on October 13, 2025, sorts the work into six categories: body treatments; light treatments; laser treatments; injectables, meaning dermal fillers, permanent makeup and “neuromuscular agents,” which it says include “Botox and Dysport”; radio-frequency and ultrasound treatments; and peels. A registered nurse may perform all six. A licensed practical nurse may perform everything except lasers, which means that in Maryland an LPN may inject a neurotoxin or a filler, something many national guides say an LPN may not do.

What the nurse needs before picking up the syringe is spelled out in regulation .05. There must be “a completed prescriptive order from an authorized prescriber” that names the procedure, the treatment area, the medication with its dosage, route and time interval, the light source and the radio-frequency or current dosage, intensity and time, and any topical anesthetic. Before the nurse treats, the prescriber must complete an initial assessment, develop a treatment plan, “be physically present in the setting,” and be “immediately available” both during the procedure and afterward to evaluate the patient. The patient’s consent must document their awareness “that it is the licensed nurse who will perform the cosmetic procedure.” Regulation .09 adds the prohibitions: no cosmetic procedures “on a standing order or protocol,” no assessments, treatment plans or prescriptions by the nurse, and no Sculptra, mesotherapy or lipodissolve injections and no invasive radio-frequency procedures at all. Peels and microdermabrasion are the exception: a nurse may do them without the prescriber in the building, though not cryotherapy.

Two consequences matter for software. The first is that the presence rule does not depend on who the prescriber is. A nurse practitioner in Maryland practices independently, and the nursing chapter says it does not restrict a nurse practitioner “from possessing, prescribing, evaluating, or performing” these procedures, so a practice owned by a nurse practitioner needs no physician at all. But when that practice’s registered nurse injects, the nurse practitioner who wrote the order is the authorized prescriber who must be in the setting. Whoever writes the order has to be in the building. The second is that a standing order, the usual way a busy practice lets nurses work from a menu, is forbidden. Every order is written for one patient, and it must carry the fields the regulation lists. A booking system that fills a nurse’s calendar with “Botox, 30 minutes” slots has to attach each one to a patient-specific order before the appointment starts, or it is scheduling something the nurse may not do.

Estheticians, and the one-millimeter line

Estheticians are licensed by a different body altogether, the State Board of Cosmetologists, under the Business Occupations and Professions Article rather than the Health Occupations Article, and that difference decides what they may do in a med spa. Two laws of 2024, Chapters 324 and 325, added “cosmetic microneedling” to esthetic services, and the Board’s regulations, revised effective March 2, 2026, limit it to devices “that have needles no longer than 1 mm” used so that they do not penetrate beyond the epidermis. The Board’s salon regulations bar anyone in a beauty salon who does not hold a health-occupation license from using lasers, from peels that go beneath the epidermis, from contouring with cryotherapy, radio frequency or liposuction, and from “any form of skin injections.” In 2026 the Board published a scope-of-practice guide in two columns. Dermaplaning, superficial peels, Hydrafacials, LED and microneedling of one millimeter or less are permitted. Botox, fillers and injectables, laser hair removal and IPL, radio frequency, HIFU, plasma pens, deeper peels, IV therapy, fat dissolving, CoolSculpting and PRP are not. “Any service that penetrates beyond the epidermis is not permissible,” it says, with “no exceptions” for anyone who does not also hold the right health license.

The physicians’ chapter closes the other door. It “does not authorize the delegation of any duties to any person who is not licensed under” the Health Occupations Article, which an esthetician is not, and the Board of Physicians told its licensees as long ago as 2010 that a physician “may not delegate performance of cosmetic medical procedures to an esthetician.” A 2024 bill that would have opened a separate path for laser hair removal did not pass. So the laser hair removal package many spas sell is, in Maryland, a procedure for a physician, a physician assistant, a nurse practitioner or a registered nurse working on an order, not for the esthetician, and microneedling is an esthetician’s service only when the needle is one millimeter or shorter. For the software, needle depth and energy source are attributes of the service, and the license that may perform it follows from them.

Physician assistants, and a chapter that is out of date

The physicians’ chapter still describes physician assistants working under “delegation agreements” approved by the Board, under which the Board may allow cosmetic procedures with the physician “immediately available” rather than on site. Delegation agreements no longer exist. The Physician Assistant Modernization Act of 2024, Chapters 919 and 920, replaced them on October 1, 2024 with collaboration agreements between a physician assistant and one or more “patient care team physicians,” and a physician may collaborate with no more than eight physician assistants at a time outside hospitals and similar settings. Cosmetic procedures are “advanced duties” that still need the Board’s approval through an addendum, which costs $100 and needs a log of at least 10 to 25 completed cases of each procedure, unless the physician assistant has at least 7,000 hours of clinical practice experience. The Board is rewriting the cosmetic chapter to match. A draft it posted in April 2026 renumbers it from 10.32.09 to 10.32.11, lets a collaboration agreement permit delegation under immediately available supervision after the physician has evaluated the patient and written the plan, and defines on-site supervision as being “physically present in the facility” and able “to respond immediately in person.” Until it is adopted, the 2010 text governs, and once it is, a citation to “COMAR 10.32.09” printed on a consent form may end up pointing to a different chapter altogether, because the Board’s wider reorganization proposes to reuse the number.

What the Board reads

The enforcement record shows why a med spa’s website and booking data belong in its compliance file. In July and September 2026, the Board of Physicians issued cease-and-desist orders against two unlicensed people performing injections in Prince George’s and Montgomery counties. Its investigators relied on websites, social media and booking platforms; one order notes that the public could book services “priced by vial quantity,” and the other quotes the procedure menu on an “appointment website.” Board staff subpoenaed appointment logs, credentials, staff lists and product invoices. In September 2026 the Board also reprimanded a physician licensed in Maryland because North Carolina had disciplined the physician over a med spa run through a national management company. On paper the physician owned the practice and was paid a flat $500 a month, but never visited it, while a registered nurse kept 91% of its revenue and the management company 9%. Maryland’s disciplinary panel called it unprofessional conduct and aiding the unauthorized practice of medicine. Who may own a Maryland med spa is less settled than who may hold the syringe: we found no Attorney General opinion or court decision that answers it directly, and anyone setting up an ownership structure should ask a Maryland health lawyer rather than a software company.

Can the first assessment happen by video?

This is the question behind the $27.99 remote exams. The physicians’ chapter says the physician must “personally perform” the initial assessment, and it says nothing about where. Maryland’s telehealth statute lets a licensed practitioner establish a relationship with a patient through a synchronous or asynchronous telehealth interaction, after verifying the patient’s identity and getting consent, and requires a clinical evaluation before treating or prescribing; it does not count care delivered “solely through audio-only calls, e-mail messages, or facsimile transmissions,” and the Board’s telehealth rule, last amended in January 2026, bars treating or prescribing “based solely on a static online questionnaire.” Our reading is that a video assessment by the physician or nurse practitioner may satisfy the assessment requirement, while nothing in either chapter lets a remote prescriber satisfy the requirement to be in the building while a nurse or a non-physician treats. The remote exam is a way to do the first step, not a way to skip the second. Software that sells remote exams should record which kind of encounter it was, synchronous video or asynchronous, and refuse a questionnaire-only path.

A unit of Botox is not a unit of Dysport

Med spa menus price neurotoxin by the unit, patients compare prices by the unit and memberships bank units, so it is worth saying plainly what the labels say about the unit. Six botulinum toxins are approved by the FDA for frown lines in the United States, and each label says, in nearly the same words, that its units belong to it alone. The Botox Cosmetic label puts it most bluntly:

“Potency Units of BOTOX Cosmetic cannot be compared to or converted into Units of any other preparations of botulinum toxin products.”

The cartons of Dysport, Xeomin and Jeuveau carry a printed warning that “dosing units of botulinum toxins are not interchangeable between commercial products.” A unit is a measure of biological activity under each manufacturer’s own assay, not a quantity of anything that two brands share.

Patients have noticed. Among Google’s autocomplete suggestions on the day we wrote this were “dysport units to botox,” “dysport vs botox units” and “how much is botox per unit near me,” which is to say that people are looking for a conversion the labels refuse to give. Published studies do compare doses across brands, and injectors develop their own working equivalences, but none of that belongs on a price list. At one price of $13 a unit, the label dose for frown lines costs $260 with Botox Cosmetic, $520 with Daxxify and $650 with Dysport, and that is before anyone asks which product lasts longer. A menu that says “$13 per unit, Botox or Dysport” is quoting two different prices for the same treatment without saying so.

What the unit means for the software

For a booking and membership system, the label language turns into a short list of rules. A price is always a price per unit of a named brand, or a price per treatment area. A membership or package that banks units banks them per brand, or banks dollars instead; “50 units of Daxxify or Xeomin” is two different amounts of treatment, since the label dose for frown lines is 40 units of one and 20 of the other. A patient’s history records the brand and units for every area treated, so that the next injector does not translate between brands in their head. And because the labels for Jeuveau, Daxxify and Letybo tell the injector to consider the cumulative dose when other botulinum toxins have been used, the chart has to carry the patient’s other recent toxin treatments, whatever the brand. Five of the labels also say retreatment should come no more often than every three months, and the sixth, Botox Cosmetic, says more frequent dosing has “not been clinically evaluated,” which is a rule a rebooking reminder can enforce rather than violate.

The vial creates rules of its own. All six are single-dose vials, and the Dysport, Xeomin, Jeuveau and Letybo labels say that once mixed, a vial is for one injection session and one patient. Five must be used within 24 hours of reconstitution and Daxxify within 72, and the Botox Cosmetic label asks the injector to write the date and time of reconstitution on the vial. That means a membership’s “banked units” can only ever be money in a ledger, never leftover product in a refrigerator waiting for the patient’s next visit, and it means the inventory system should know, for every vial, when it was mixed, at what dilution, for whom and when it must be thrown away. The waste is real and worth measuring: a 100-unit Xeomin vial opened for a 64-unit treatment of all three upper-face areas, the most its label allows, leaves 36 units that cannot go to the next patient.

The counterfeit that a lot number would have caught

In April 2024 the CDC warned that people in several states had been harmed by counterfeit or mishandled Botox, injected in many cases by unlicensed people or in settings such as homes; it eventually counted 17 people in nine states, 13 of whom were hospitalized. The FDA’s alert described how to spot the fake: its carton and vial carried lot number C3709C3, indicated a 150-unit dose, “which is not a unit made by AbbVie or Allergan,” and called the drug “Botulinum Toxin Type A” rather than onabotulinumtoxinA. According to the CDC’s weekly report, that lot number belonged to a genuine 100-unit batch that had expired in August 2017. The genuine labels give their own checks: Botox Cosmetic tells injectors not to use a vial without “U.S. License number 1889” on the label, and Dysport’s tells them to look for a hologram on the carton. And the FDA reminded providers that federal law requires everyone who dispenses or administers prescription drugs to “purchase those products only from authorized sources.”

We found no federal rule that requires a med spa to write the toxin’s lot number into the patient’s chart. It is still the single most useful field in this part of the system, because it answers the question a recall, a counterfeit warning or a patient’s complication will ask: which vials, from which supplier, went into which patients. A system that scans the carton’s barcode on receipt, records the lot and expiry, checks the supplier against an approved list and links each vial to the patients it treated can answer that question in a minute.

The list of products will keep changing. Galderma’s relabotulinumtoxinA, approved as Relfydess in more than thirty other markets, received a complete response letter from the FDA in mid-2026 and is not approved here, and AbbVie’s trenibotulinumtoxinE, whose effect lasts two to three weeks, received one too, though Europe approved it in July 2026. A catalog that assumes every toxin is rebooked at twelve weeks, or that a new brand’s units mean what the old ones did, will be wrong the day the next one arrives.

The shelf: what the store may sell, and what only the doctor may hand over

A med spa’s retail shelf holds three different kinds of product that look the same in a shopping cart. The first is cosmetics: cleansers, serums, moisturizers and most of what the skincare brands sell to practices. Anyone may sell them, ship them anywhere and run a subscription on them, and Maryland taxes them at 6%; its sales tax regulation says a product “that is primarily cosmetic in nature is not ‘medicine’ even though it may contain medicinal properties.” The second is over-the-counter drugs, which a “general merchant” may also sell, and which Maryland generally exempts from sales tax as medicine. The third is prescription drugs, and in Maryland that third category does not belong in an online store at all.

The line between administering and dispensing is drawn in Health Occupations §12-102. Administering is “the direct introduction of a single dosage of a drug or device at a given time, whether by injection or other means,” and a physician or nurse may do it in the course of treating a patient without any permit. That covers the toxin injected in the treatment room and a weekly weight-loss injection given in the clinic. Dispensing, which is what happens when a patient leaves with tretinoin, a bottle of Latisse or a box of weight-loss pens to use at home, is a different matter. A Maryland physician may dispense prescription drugs only with a permit from the Board of Physicians, and only “when a pharmacy is not conveniently available to the patient,” a determination that, under the regulations, must be made “solely by the patient” on a form the patient signs and dates before the first dispense.

The permit is a small regulatory program of its own. It costs $1,050 for five years, of which $1,000 goes to the state’s Office of Controlled Substances Administration to pay for inspections. It requires ten continuing-education credits on dispensing over each five-year term, a sign in the office, a written prescription handed to the patient, records kept for five years, purchases only from suppliers holding Maryland permits, and an annual report filed within 15 days of the permit’s anniversary; miss that report without good cause and the permit “automatically lapses,” and “a lapsed permit may not be reinstated.” The physician must be on the premises and personally perform the final check of each drug dispensed, and the lot number of any drug taken from a stock bottle must be recorded so that it “can be correlated with any patient’s prescription for that drug.” And under COMAR 10.32.23.06, “a permit holder may not dispense medications by: (1) Mail order; or (2) A refill.” The Board’s telehealth rule repeats the mail-order prohibition for prescriptions written remotely.

For an online store, that last sentence settles the design. A Maryland physician’s practice may not ship a prescription drug to a patient, and may not run an automatic refill. Prescription skincare, eyelash serum and weight-loss pens can be prescribed online, after a proper evaluation, and filled by a pharmacy, which may ship them; or they can be handed over in person, by a permit-holding physician, against a new prescription each time. What they cannot be is a product in a cart with a shipping option and a “subscribe and save” box. None of the Shopify catalogs we read in Baltimore listed a prescription item, which suggests most practices have worked this out; the risk is in the add-on apps and turnkey programs that make a subscription look like any other product.

The eyelash exception, and who else may dispense

Maryland has exactly one shortcut, and it is narrower than it looks. Health Occupations §14-509 lets a physician dispense “a topical medication that is approved by the federal Food and Drug Administration for the treatment of hypotrichosis” without the full permit or its continuing education, with a special permit that costs $100 and one hour of continuing medical education a year. Hypotrichosis means too little hair; Latisse is approved for hypotrichosis of the eyelashes, and in practice the law describes Latisse. It does not cover tretinoin, hydroquinone or anything else, even though the general statute’s cross-reference speaks of “a topical medication.” It matters in Baltimore: 16 of the 53 Allē directory listings in the City and County offer Latisse, and five offer Upneeq, a prescription eye drop for drooping eyelids, which gets no shortcut at all. Hydroquinone is its own story, which our article on beauty supply stores tells: since 2020 there has been no lawful over-the-counter hydroquinone, and the FDA says Tri-Luma is the only approved drug that contains it.

Nurse practitioners, who own a growing share of med spas, have less room still. A Maryland nurse practitioner may hand out free starter doses, but may dispense more only in workers’ compensation clinics, nonprofit clinics and hospitals, campus health centers and public health facilities, a list that does not include a for-profit med spa; a permit-holding physician in the same office may dispense a nurse practitioner’s prescriptions, and a physician assistant may dispense when the collaborating physician holds a permit. A “starter dosage” must be free and only enough to begin therapy, and the Board of Physicians limits a physician’s starter dosage to a 72-hour supply, which a weekly weight-loss pen exceeds. For the software, every product in the catalog needs a route: cosmetic, over-the-counter drug, prescription, controlled substance or administer-only, and the cart, the tax engine and the dispensing log each read that one field.

Weight loss: the compounded era ended, and the price fell

Twenty-two of the 52 Baltimore sites we read offer GLP-1 weight-loss programs. Only three publish a price, seven say the drug is compounded, and four name a brand. The legal ground under those programs moved in 2024 and 2025. The FDA declared the shortage of tirzepatide resolved in October 2024, confirmed it that December, and declared the shortage of semaglutide resolved on February 21, 2025. Once a drug is off the shortage list, pharmacies may no longer make what the FDA calls “essentially a copy” of it except in limited circumstances; the agency’s grace periods ended in early 2025 for ordinary compounding pharmacies, and on March 19 and May 22, 2025 for outsourcing facilities. On April 30, 2026 the FDA proposed excluding semaglutide, tirzepatide and liraglutide from the list of substances outsourcing facilities may compound from, and its consumer page, updated October 1, 2026, counts 990 adverse-event reports for compounded semaglutide and more than 730 for compounded tirzepatide as of May 31, 2026. Maryland adds a restriction of its own: its pharmacy law lets a pharmacy supply compounded drugs for office use without a patient-specific prescription only to ophthalmologists, for a short list of eye emergencies, and the FDA says neither semaglutide nor tirzepatide is currently on the list outsourcing facilities may compound from. We see no lawful route for a Maryland med spa to keep compounded semaglutide on its shelf as office stock.

The other thing that changed is the price. On October 22, 2026, Novo Nordisk’s NovoCare pharmacy listed the Wegovy pill at $149 a month for the starting dose and $199 to $299 for higher ones, and the Wegovy pen at $349 a month after a $199 introductory price for new patients. Lilly listed Zepbound for self-paying patients “starting at” $299 a month, and its new pill, Foundayo, approved on April 1, 2026, at $149 to $349 depending on the dose. The government’s TrumpRx site shows the same headline prices. The three Baltimore programs in our count that publish prices charge from $180 for four weekly tirzepatide injections at a starting dose to $375 and $475 for a month of semaglutide or tirzepatide, or $450 and $700 for six weeks. A med spa can still run a weight-loss program around an approved drug, as a clinical service with visits, monitoring and coaching, but the drug itself is now often cheaper bought from its manufacturer than from the spa, and that changes what the program is really selling. The FDA has also told sellers what they may not say. In February 2026 it said companies “cannot claim that non-FDA-approved compounded products are generic versions or the same as drugs approved by FDA,” nor that they use the same active ingredient or are clinically proven, and in March it sent warning letters to 30 telehealth companies.

One adjacent clinic in our search shows how to write about this honestly. Rivas Medical Weight Loss in Perry Hall, which does not offer toxins and so sits outside our count, states plainly that compounded semaglutide “is not FDA-approved, is not the same as Wegovy,” publishes its monthly prices and warns that syringe units “are not interchangeable across concentrations.” For the software, a weight-loss product needs its active ingredient, its strength in milligrams, its concentration, whether it is an approved brand or compounded and by whom, and a price normalized to a month; “units” on a syringe mean nothing without the concentration, and the FDA tells patients to discard a multiple-dose vial 28 days after its first use.

IV drips: no permit, but a four-hour clock

Twenty-four of the 52 sites offer IV hydration or vitamin infusions, some of them as monthly memberships from about $119 to $699. Maryland once required a sterile compounding permit even for a health care practitioner’s office that mixed sterile drugs, under a 2013 law, but it repealed that requirement in 2015 before it was ever enforced, so today no state permit covers a drip room. What remains is the standard of care written into the pharmacy profession’s chapter on sterile compounding, USP <797>, revised effective November 1, 2023: a bag mixed for “immediate use” may combine no more than three different sterile products, and administration must begin within four hours of the start of preparation, or the bag is discarded. A registered nurse may start the infusion only on a prescriber’s order; an esthetician may not do it at all, as the Board of Cosmetologists’ list says. For the software, every IV bag gets a preparation time, a list of what went into it and a deadline, the same way every reconstituted toxin vial does.

The photos are medical records, whether or not HIPAA applies

The usual first question about privacy is whether HIPAA applies to a med spa, and the honest answer is that it may not, and that it matters less than most owners think. HIPAA’s privacy rules bind a health care provider only if it “transmits any health information in electronic form in connection with a transaction” covered by the federal standards, meaning claims, eligibility checks, prior authorizations and the like. A practice that has only ever been paid in cash and by card, and has never billed or checked a health plan electronically, can sit outside it, and the CMS decision tool asks exactly that question. But a weight-loss program can change the answer without anyone noticing. Checking a patient’s pharmacy benefit or submitting an electronic prior authorization, even by typing into a payer’s web portal, which the regulations call “direct data entry,” is very likely a covered transaction, and once a practice conducts one, HIPAA applies to every patient record it holds, the cash-paying ones included.

Maryland makes the question smaller still, in two ways. The physicians’ cosmetic chapter requires the delegating physician to keep medical records “in compliance with” Maryland’s records law “and with” HIPAA, so a physician who delegates at a med spa can be disciplined over records that fall short of HIPAA even if the federal government has no jurisdiction over the practice. And Maryland’s own Confidentiality of Medical Records Act applies to every person licensed under the Health Occupations Article and to their “agents” and “employees,” whatever their billing. It defines health care to include care “that affects the structure or any function of the human body,” which takes in a cosmetic injection, and a medical record as information “in any form or medium” that is entered in a patient’s record, identifies the patient and relates to their care. A before-and-after photo stored in the chart is a Maryland medical record. A photo left on an injector’s phone may not be, which is a reason to take photos inside the charting software rather than with the camera app. A 2026 bill that would have extended the definition to audio, video and electronic messages was withdrawn after an unfavorable committee report.

Seven years, one year and twenty-one working days

Three numbers from the Maryland law belong in any med spa’s software. The first is seven. Since October 1, 2024, under Chapter 779 of 2024, a provider may not destroy a medical record for seven years after it is made unless the patient is notified, up from five, and for a minor patient until the age of majority plus seven years; a 2025 law lets the destruction notice go by e-mail, followed by a mailed notice at least ten days before destruction if the e-mail gets no reply or delivery receipt, and the records must be available for the patient to collect during the 60 days before. The Board of Nursing added an explicit records duty to its cosmetic chapter in October 2025. Charts, photos, consent forms, treatment plans with their device settings and lot numbers all sit on the same seven-year clock.

The second is one. Every authorization to disclose a record must be written, dated and signed, must name who will receive the information, and must “state the period of time that the authorization is valid, which may not exceed 1 year.” Maryland’s law has no exception for marketing. So the consent a patient signs to let the practice post their before-and-after photos on Instagram expires, at the latest, a year after it is signed, and a revocation takes effect when the practice receives it. Whether a post that stays up after the year has run counts as a fresh disclosure is a question for a lawyer, but the software should at least know the date, remind someone before it arrives and turn a revocation into a takedown task. Federal enforcement shows what is at stake: in 2025 the HHS Office for Civil Rights settled with a group of Delaware care facilities for $182,000 and a two-year corrective plan after the facilities posted patients’ names, photographs and “success stories” without authorization, and earlier settlements have involved testimonials with full-face photos and replies to online reviews that revealed patients’ information.

The third is twenty-one. The law asks a provider to hand over a copy of a record “within a reasonable time,” and makes a provider that knowingly refuses for more than “21 working days” liable for actual damages. A practice covered by HIPAA also faces HIPAA’s 30-day deadline, which can be extended once; the Maryland clock does not stop for the extension. For copies, the statute sets a base of 76 cents a page plus postage, and for electronic copies a per-page fee of 75% of the paper rate, capped at $80; the per-page fees may be adjusted for inflation, and the preparation fee of up to $22.88 is subject to HIPAA’s limits on what a patient may be charged. A request log with both deadlines and a fee calculator is a small piece of software that saves a real argument.

Reviews, results and the privacy law that may still apply

The advertising rules point the same way. The Board of Physicians forbids physicians to advertise with statements “intended to, or likely to, create false or unjustified expectations of favorable results,” and the Federal Trade Commission’s rule on reviews and testimonials, in force since October 2024, bans fake reviews, rewards for reviews conditioned on a particular sentiment and the suppression of negative ones, with civil penalties of up to $53,088 per violation, a figure the FTC left unchanged for 2026. Under the Commission’s endorsement guides, a before-and-after photo presented as a patient’s result is likely to be read as what other patients can generally expect, so the advertiser needs evidence that it is or must say clearly what is typical. A gallery is marketing, and its software should know which photos may appear in it, under which consent, until when.

Finally, a med spa that is not covered by HIPAA should not assume it is outside privacy law. The Maryland Online Data Privacy Act exempts medical records only when they are held by a HIPAA covered entity or business associate that applies HIPAA’s standards. A cash-only practice that crosses the Act’s threshold of 35,000 Maryland consumers in a year gets no such exemption, and the health information it holds is “sensitive data” that may be collected only where strictly necessary and may never be sold. Most single-location med spas will stay under the threshold, but a practice with a large membership base, an e-commerce store and a mailing list should count, which our article on the Act explains how to do. Tracking pixels on a booking page are a common way this goes wrong: a page that sends a visitor’s e-mail address and the treatment they asked about to an advertising platform is disclosing exactly the information both laws protect.

Memberships, banked units and the advertised price

A med spa holds a surprising amount of its patients’ money: membership dues not yet used, treatment packages paid in advance, gift cards, deposits and, in the newer programs, dollar balances that roll over from month to month. Most of the rules about that money are general consumer law that other articles in this series have covered, so I will be brief about them and spend the space on what is particular to aesthetics.

Start with the ledger. Whatever a membership banks, the practice owes it until it is used, and the earlier sections fix what can be banked: units of a named brand, or dollars, never generic “units,” and never leftover product, because a mixed vial is good for 24 or 72 hours and one patient. The liability for banked units is the units remaining times the price the patient paid for each, kept per brand. A practice that cannot produce that number on demand does not know what it owes, and a practice that changes its toxin supplier with 2,000 banked Botox Cosmetic units outstanding has a conversation to have with every one of those patients.

Some prepaid programs may also be regulated as something else. Maryland’s Health Club Services Act covers agreements longer than three months where more than three months are paid in advance, and its definition expressly includes services rendered by “a health spa, figure salon, weight reduction center” and other enterprises devoted to “physical fitness or physical well-being.” A seller covered by it must register, post a bond sized to the money it holds in advance, up to $200,000 per facility, give buyers three business days to cancel and use a prescribed notice of consumer rights. We found no ruling on whether a physician-directed med spa or a medical weight-loss program falls inside that definition; a practice selling six-month weight-loss programs paid up front should ask the Attorney General’s Health Club Unit before assuming it does not. Our article on fitness studios explains how the Act works, and the same article covers the general automatic-renewal law that took effect on June 1, 2026, which since then has required the renewal price to sit next to the consent, cancellation to be at least as easy as sign-up and, for terms of a year or more, a reminder 15 to 45 days before renewal. At the federal level the FTC’s “click to cancel” rule was struck down in July 2025, but the older Restore Online Shoppers’ Confidence Act still requires clear terms and an easy way to cancel, and the FTC’s July 2026 lawsuit against the telehealth company Hims & Hers, which alleges that patients were signed up for recurring prescription subscriptions by submitting an intake form and then found them hard to cancel, shows the agency applying it to exactly the kind of program med spas now sell. Those are allegations, not findings.

Gift cards follow the general rules: under Maryland law no expiration date or fee may apply within four years of purchase, federal rules set five years for most store cards, and since October 1, 2025 a business that sells its own gift cards online must show the Attorney General’s scam-warning notice on the page where the card is sold or before the sale is completed. Manufacturer-issued gift cards, which Allergan sells to Allē members on its annual Juvéderm Day, are not the practice’s liability and should not sit in the same ledger as the practice’s own. Deposits and no-show fees need two stored facts, the policy the patient accepted and the consent to charge the card, both with timestamps, because those are the evidence that wins a card dispute.

The 72-hour rule on free consultations

The price on the menu is also regulated, and here the physicians’ rules contain a provision that most med spa marketing seems never to have met. COMAR 10.32.01.13, the Board of Physicians’ advertising rule, says a physician’s advertisement may not contain statements “advertising discounted or free services, examinations, or treatments when there will be an additional charge for any additional services, examinations, or treatments which are performed as a result of and within 72 hours of the initial office visit in response to the advertisement,” unless there is a genuine emergency. The same rule says an advertised fee must include “the cost of all related procedures, services, and products” that will very likely be needed to complete the advertised service, allows a price range only “if reasonable disclosure of all relevant variables” is made, and holds the physician accountable for advertising placed through an agent or a business entity. Read plainly, a physician-run practice that advertises a free consultation and sells a toxin treatment at the same visit is doing what the rule describes. Seven of the 53 Allē listings in Baltimore City and County show a consultation fee of zero, which is not a problem in itself; what the rule cares about is what is charged in the 72 hours that follow. A booking system for a physician practice can enforce this mechanically: a visit booked through a free or discounted offer carries a 72-hour window in which nothing chargeable may be scheduled.

The federal guides on comparative prices apply to everyone. Under the FTC’s pricing guides a “was” or “regular” price should be one at which the item was actually offered to the public, in good faith, for a reasonably substantial period, and a “free” offer for a given service should not run for more than six months in any twelve in the same area. The software answer to both is the same: keep the price history of every service and product, so that a “normally $15 a unit” claim can be shown to be true.

The Baltimore layer: where a med spa may open, and what the shelf does to that

Location rules rarely make it into software, but for a practice planning a second site they decide the plan, and Baltimore City and Baltimore County read a med spa differently. The City’s zoning code has no category called “med spa.” A practice run by physicians or nurse practitioners most naturally fits its “health-care clinic,” defined as a facility for outpatient examination and treatment by “1 or more physicians, dentists, chiropractors, physical therapists, or other licensed healthcare practitioners”; an esthetics studio with no medical services is a “personal services establishment,” the category that also covers beauty shops. The difference matters on the map. Under the City’s zoning code, a health-care clinic is permitted outright in the C-2 through C-5 commercial districts, the OR office-residential district and the transit-oriented districts, but needs a conditional-use hearing before the Board of Municipal and Zoning Appeals in the neighborhood commercial districts, C-1 and its variants. It is not permitted at all in the rowhouse and multifamily districts, R-5 through R-10, and the exception that lets old corner-store buildings in those districts reopen as offices, shops or personal services does not list health-care clinics. A neighborhood storefront that would be fine for a facial studio may need a hearing, or be out of reach, for an injector.

The County’s regulations contain a sentence that turns the retail shelf into a zoning question. Its definition of “office” includes “a medical office” but excludes “an establishment where merchandise is stored on or sold from the premises.” In the business zones, BL, BM and BR, that hardly matters, because offices, medical clinics, beauty shops and retail are all permitted. In the residential-office zone, R-O, which is built around houses converted to offices, it matters a great deal: medical offices may occupy no more than 25% of the adjusted floor area of such a building, and selling merchandise is not an office use at all. In the office-residential zone OR-1, personal-care uses such as facial treatment are allowed only by special exception, as accessory uses limited to 7.5% of the building and 1,200 square feet each. A practice that wants to sell skincare from a converted house in Towson should check the zone before it orders the shelving.

Selling goods brings one more local paper. Maryland requires a trader’s license for “each store or place of business” that sells goods, with fees that rise with the value of the stock, and in Baltimore County the clerk “may not issue a trader’s license for the first time without the approval of the zoning commissioner.” A med spa that employs estheticians may also need a beauty salon permit from the Board of Cosmetologists for the space where they work, a point we found no board guidance on and would check before opening.

Two state registrations that people expect turn out not to apply in the usual case. Maryland’s environmental agency defines radiation broadly enough to include lasers, light and ultrasound devices, but its regulation says machines producing non-ionizing radiation are “State certified until the time the Department promulgates regulations,” so a hair-removal laser has no state certification cycle today; an X-ray body-composition scanner would. And the Office of Health Care Quality licenses an office as an ambulatory surgical facility only when it seeks reimbursement as an ambulatory surgery center, which excludes a practitioner’s office with no more than one operating room that charges no facility fee. A med spa that adds surgical procedures under anesthesia should read that definition closely; one that injects and treats with lasers is a practitioner’s office in the eyes of the state.

What 52 Baltimore med spa websites show

To see how the trade presents itself, we built our own list. Maps data is thin for this business: OpenStreetMap knew only six of the places we eventually counted. The better source turned out to be Allergan’s Allē provider directory, whose search answers without a login and returned 140 distinct providers in three searches around the city; we added targeted searches and the chains’ own location pages. We kept every business that offers neurotoxin injections or medical laser treatment as a core service and has a location inside Baltimore City or Baltimore County, placing each address inside or outside the two jurisdictions’ boundaries on a map rather than trusting the town in its mailing address. That gave 59 locations belonging to 56 businesses, 10 locations in the City and 49 in the County. Of the 52 websites we could read on October 22, 2026, 33 belong to independent med spas, 13 to physician practices, mostly plastic surgery and dermatology, with an aesthetics arm, four to national or regional chains, one to a regional group and one to an IV and wellness clinic that also injects toxin. Another 87 Allē listings sit just outside the two jurisdictions, in places such as Annapolis, Columbia, Bel Air, Severna Park, Ellicott City and Glen Burnie, which is a reminder that Baltimore patients have plenty of choice a short drive away.

The price per unit, and the unit nobody names

Eleven of the 52 sites publish a price per unit of neurotoxin. The regular prices run from $12 to $14, with $13 the median; member and new-patient prices go down to $10 and $10.50. Ten of those eleven quote one price that covers two or more brands, usually “Botox/Dysport,” sometimes Daxxify or Xeomin as well. None of the 52 sites says that a unit of one brand is not a unit of another, which each product’s FDA label says plainly, as we showed above. At a single $13 price, the label dose for the frown lines between the eyebrows costs $260 with Botox Cosmetic, $520 with Daxxify and $650 with Dysport, because the three labels call for 20, 40 and 50 units. The one site we found that prices brands separately, Expert Esthetic Skin Care, lists Botox at $13 a unit and Jeuveau at $11.50. A membership in our sample that includes “50 units” of either of two brands a quarter is offering two different quantities of treatment under one number.

Who is in the room

Thirty-two sites show some credential for the people who inject: physicians, MD or DO, on 16, nurse practitioners on 16, physician assistants on 11 and registered nurses on 11, often several on one site. Only six name a medical director, and only six say that a consultation or assessment comes before the first treatment. That is not evidence that the other practices skip the assessment; many simply do it without saying so on the website. But a booking page that lets a new patient pick a time for “Botox” with a registered nurse, with nothing in between, is describing a workflow Maryland’s rules do not allow, and the Board of Physicians has started to read booking pages as evidence, as we explained above.

Memberships, deposits and stores

Eight sites publish membership prices, from $20 to $699 a month. Two of the clearest are Gloss Medical Aesthetics & Laser, which states its toxin club’s full terms on the page, including a $250 enrollment fee, $175 a month, a six-month minimum and no rollover of unused sessions, and LongJuve in Hunt Valley, which lists four tiers from $20 to $249 a month. Three run what is effectively stored value: two put the monthly dues into a dollar balance, one of which rolls over, and one includes a fixed number of toxin units each quarter. Fifteen sites post a deposit or no-show policy, ten of them with a dollar amount, from $25 to $250 with $50 the median, against a 24-hour or 48-hour notice window. Thirty-three show financing logos, CareCredit and Cherry the most common, and 33 have a before-and-after gallery.

Seventeen sell skincare or supplements online in some form. Eight run their own store, on Shopify, WooCommerce, Wix, Squarespace or a separate domain; nine send patients to a store someone else runs, such as Allergan’s Brilliant Connections storefronts carrying the practice’s name, referral pages for ZO Skin Health, Alastin or skinbetter, or a supplement dispensary. None of the Shopify catalogs we read listed a prescription item, which is as it should be, for the reasons given above.

The software behind the button

We could identify a booking or practice platform on 30 of the 52 sites. Aesthetic Record was the most common, on 12, followed by Jane on 5, Boulevard on 4, and ModMed and Square on 3 each; Mangomint, PatientNow, Zenoti, Vagaro, AestheticsPro and RepeatMD appeared once each. The other 22 sites show a phone number, a form or nothing we could recognize. For search and AI assistants, 43 sites have some structured data, but only 12 use the MedicalBusiness type, 7 MedicalClinic and 5 any Offer; one has FAQPage markup. Nineteen have an llms.txt file, at least three of them generated automatically by a plugin or by Shopify, and none of the 52 blocks the main AI crawlers in its robots.txt.

The directories have problems of their own. Two listings in the area still describe locations of a national laser chain whose website now shows a domain-parking page. In the Allē directory, one hospital-affiliated med spa’s website link now redirects to an unrelated gambling site, and two listings show a consultation fee of one cent, almost certainly a typing slip. Two practice websites still promote Brilliant Distinctions, the Allergan loyalty program that Allē replaced. Directory data is somebody else’s software; it is worth checking what it says about you every few months.

The e-commerce half: the booking page is the store

For most retail businesses in this series, the online store is a catalog with a cart. For a med spa, the store is the booking page, the membership signup and a small skincare shop, and the rules above decide what each of them may do. The useful way to design it is to start from what patients ask, then what the platforms that send them will allow, and only then from what the software can do.

What patients search for

Google’s autocomplete suggestions on October 22, 2026 tell the story of the previous sections in the patients’ own words. Around price, they ask “how much is botox per unit,” “botox near me prices,” “dysport units to botox” and “daxxify vs botox units,” and for each newer brand, “letybo vs botox” and “letybo price per unit.” Around weight loss, they ask “is compounded semaglutide legal again,” “compounded tirzepatide recall” and “med spa near me glp 1.” Around the practice itself, they search “botox baltimore county,” “botox baltimore canton” and “best med spa baltimore,” and the trade’s own questions show up too: “good faith exam med spa,” “can a medical assistant reconstitute botox” and “how long does botox last after reconstitution.” Most of those questions have a precise answer in a label, a statute or a regulation, which is exactly the kind of answer a practice’s own website can give better than a directory can, provided it names its brands, prices them separately and cites what it relies on.

The pages that rank for those questions today are a mixed lot. For the unit questions, the top results include conversion pages that quote ratios of 2.5 or 3 Dysport units to one Botox unit, contrary to every label; one is a trade article from 2010 and another appears cloned on two unrelated sites. For “can a nurse do botox in maryland,” the most prominent Maryland government page in the search results we checked was a 2012 bulletin from the Board of Dental Examiners about dentists, and neither the Board of Physicians nor the Board of Nursing appeared at all; the Board of Cosmetologists’ 2026 guidance is live as a web page while the PDF addresses that search engines still show return errors. Several telehealth pages still say semaglutide “remains on the shortage list” in 2026, while the FDA’s database says “Resolved.” These are the pages AI assistants summarize when nobody local has written anything better.

What the ad platforms allow

The paid side has its own rules. Under Google’s healthcare and medicines policy, prescription drug terms such as Botox, Dysport, Xeomin, semaglutide and tretinoin may appear in U.S. ad text and on landing pages without certification, but “you must be certified in order to keyword-target these terms,” and the certifications Google offers are for online pharmacies, telemedicine providers, drug manufacturers and similar businesses. A med spa that is none of those may write “Botox” in its ad but, on our reading, cannot bid on the word. Google’s list of prescription terms does not include Jeuveau, Daxxify or Letybo, though it says the list is not exhaustive. Separately, Google’s personalized-advertising policy treats “invasive medical procedures, including cosmetic surgery, surgical procedures, or injections” as a sensitive health category in which advertisers may not use their own audiences, so a practice may not upload its patient list for Customer Match or retarget its past visitors with injection ads. Meta requires ads for cosmetic procedures and weight-loss products to be targeted to adults, allows before-and-after images of cosmetic procedures for adult audiences, and requires prescription weight-loss drug ads to pass LegitScript certification or Meta’s own review and carry a prescription disclaimer.

For software, this means the catalog needs a flag for every service and product whose name is a prescription drug term, and the marketing tools must read it: no keyword targeting without certification, no audience uploads for injection or weight-loss campaigns, an adult-only setting on social campaigns, and no health questions in social media lead forms, which Meta does not allow without its prior permission.

What the AI shopping agents will not sell

The newest channel is the most restrictive. Google’s agentic checkout, which lets its AI mode buy on a shopper’s behalf, excludes subscriptions, installment plans, services, bundled services and “healthcare/pharmaceuticals,” and a product is ineligible unless the merchant switches it on. OpenAI’s commerce protocol for ChatGPT prohibits “prescription-only medications.” For a med spa, that leaves one candidate: plain, returnable, non-prescription skincare. Memberships, packages, financed purchases, treatments and anything with a prescription behind it will be found by AI assistants, if the pages are good, but bought on the practice’s own site.

Markup that machines read, and what Google has stopped reading

Being found is still worth the work, but some popular advice is out of date. Schema.org has no “med spa” type; the closest fit is to declare the business as both a MedicalClinic and a DaySpa, which Google’s local business documentation allows as an array, and to describe each service as an Offer with a price and the brand named. Google does not show review stars for a business’s reviews of itself, so self-serving AggregateRating markup on the clinic’s own pages earns nothing. Google stopped showing FAQ rich results on May 7, 2026, and its AI optimization guide now says that Google Search ignores llms.txt files. We still publish one, since Google itself says it is fine to keep one for other services that use these files and it costs nothing, but nobody should expect it to move a Google ranking. What does move both search and AI answers is a page that answers the question plainly, with the brand, the price, the unit, the credential of the person who treats and the rule it relies on, which is precisely what our census found missing on most Baltimore sites.

A note for readers in Lithuania

Part of our team works from Lithuania, and the comparison is instructive, because the European Union and Lithuania regulate the same treatments from the other end. In the United States the FDA regulates the product and each state decides who may use it. In the EU, the medical-device regulation reaches products that have no medical purpose at all: Annex XVI of Regulation (EU) 2017/745 lists substances “intended to be used for facial or other dermal or mucous membrane filling” by injection, equipment to reduce or destroy fat, and lasers and intense pulsed light “for skin resurfacing, tattoo or hair removal or other skin treatment.” Since June 22, 2023, common specifications under Implementing Regulation (EU) 2022/2346 have put rules on the products themselves. A filler’s label must say it is “only to be administered by appropriately trained healthcare professionals who are qualified or accredited in accordance with national law,” and that it is not to be used on anyone under 18. The filler must also come with a handout for the patient that records the location, number and volume of the injections; professional lasers need access control and an annual check of their energy output. Products already on the market may stay there during transitional periods that now run to the end of 2028 or 2029.

Who may inject is national law, and Lithuania’s answer is narrow. The state agency that licenses health care, VASPVT, said in 2023 that only dermatovenereologists and plastic and reconstructive surgeons may inject botulinum toxin or hyaluronic acid, with maxillofacial surgeons allowed in the face and neck, and that nurses and cosmetologists may not, whatever training a filler maker has given them; the fine for providing health care without a license is €600 to €1,140. Lithuania also licenses twice. The specialist needs a license, and the clinic’s own license must list that service at that address, so a booking system there has to check two keys for every appointment rather than one. The health ministry’s order on outpatient aesthetic surgery even requires a contract with each patient that covers paying for complications and an agreement with a hospital that can receive a patient within 40 minutes.

Two details echo the American story. Lithuania’s medicines register records toxins in their own units, “Speywood” units for Azzalure and Alluzience and “Allergan” units for Vistabel and Botox, so the regulator itself treats a unit of one brand as something different from a unit of another, and the brand names differ from the American ones: Vistabel is Allergan’s cosmetic Botox in Europe, Azzalure and Alluzience are Galderma’s versions of Dysport, and Bocouture, Merz’s European name for Xeomin, is not registered in Lithuania at all. And Lithuanian clinics do not sell toxin by the unit. In our sample, none of 126 priced lines on the booking marketplace manodaktaras.lt and none of ten clinic price lists quoted a price per unit; all priced by zone, often with small, medium and large tiers, and the frown-line treatment cost between €90 and €175, with €130 the median.

The online store looks different too. In Lithuania only pharmacies may sell medicines at a distance, prescription medicines only against an electronic prescription, and its pharmacy law forbids a pharmacy-made preparation identical to a registered medicine, so there is no Lithuanian equivalent of compounded semaglutide; a Wegovy 2.4 mg pen cost €183.78 at a large pharmacy chain on October 22, 2026, or about €2,389 a year. Prescription medicines may not be advertised to the public, and advertising for health-care services may not use a patient’s name, surname or image, which on our reading rules out the kind of before-and-after gallery that 33 of the 52 Baltimore sites we read display. A clinic that operates in both countries needs a rules engine with a country switch, not two copies of the same website.

What custom actually costs, and when it pays

We price every project at a fixed fee, agreed before we start, and publish the starting points on our pricing page. For a Baltimore med spa, whether it is a nurse practitioner’s two-room practice in Canton, a dermatology group with an aesthetics arm in Towson or a laser and injectables studio in Owings Mills, the packages map onto this article like this.

Most of our projects land between $6,000 and $30,000, and none requires you to give up an EMR, an accounting system or a payment processor that already works; the demos page shows finished work. In Maryland, the state’s 3% tax on software and IT services applies to a custom build, so the Online Store package starts at $6,180 with tax and a Custom App at $12,360.

Be clear about what custom does not save. In our model practice the subscriptions are the small number: $1,596 a year for Aesthetic Record’s higher plan at seven users, or $4,368 to $6,240 for Boulevard’s med spa bundles at their promotional and list prices, against roughly $44,800 in card and financing fees that no choice of software removes. An Online Store build at $6,180 with tax costs almost four years of that Aesthetic Record subscription. It pays only where the subscription cannot do what the practice needs: where the booking page has to know who has been assessed, who is in the building and which consents are on file; where memberships bank units by brand and the liability has to reconcile; where the store has to refuse a cart that a Maryland permit would not allow; or where the practice wants its patient records and payment history in a system it owns. Measured against those risks the build is cheap, since the civil fine for unauthorized practice runs to $50,000, a lapsed dispensing permit cannot be reinstated and fighting one chargeback on a $50 no-show fee costs up to $30. Measured against a subscription that already does all of that well, it is not, and you should keep the subscription.

What we would build for a Baltimore med spa

We would not build an electronic medical record. The charting systems this trade runs on have spent years on templates, face maps, photo capture, e-prescribing and the integrations with pharmacies and labs, and a practice whose charting works should keep it. We would not build a payment processor, a financing program or an accounting system either, and we would not try to replace the manufacturers’ loyalty programs, which patients like and which carry the manufacturers’ money. What we would build is the layer the Maryland rules now require around all of them: a record of who has been assessed, who may treat whom with what, who is in the building, which unit belongs to which brand and which product may go into a cart.

The first piece is an assessment-first booking flow. The online calendar knows whether the person booking is a new patient, an existing patient with a current treatment plan, or an existing patient whose plan does not cover what they are asking for, and offers different products to each: a consultation and assessment with a physician or nurse practitioner for the first, a treatment slot for the second, a plan review for the third. For a nurse’s appointment it checks that a patient-specific order exists, names the area, the drug and the dose, and was written by a prescriber, so that no slot fills on the strength of a standing order the Board of Nursing forbids. If the assessment is done by video, the flow records whether the visit was synchronous or asynchronous and refuses a questionnaire-only path.

The second is a schedule that knows who is in the building. Every delegated service, every nurse’s injection and every laser session by anyone other than the prescriber carries a supervision requirement, and the calendar shows those slots only while a qualified physician or nurse practitioner is scheduled on site for the whole appointment and a short window after it. When the medical director’s afternoon changes, the affected slots close and the affected patients are offered new times before anyone has to notice. Each provider carries the credentials that decide what they may perform: license type and number, expiry, the Board’s advanced-duty approval or the 7,000-hour attestation for a physician assistant, annual competency dates for nurses, and the needle-depth and energy limits for an esthetician.

The third is a unit-and-vial ledger. Prices, packages and banked balances are kept per brand, or in dollars, never in generic units. Each vial is received with its lot and expiry, read from the carton’s barcode, checked against an approved-supplier list, reconstituted with a recorded dilution and time, assigned to one patient’s session and discarded by its deadline, and the units charted to each area reconcile against the vial. A recall or a counterfeit warning becomes a query, not an afternoon with paper charts. The same ledger tracks IV bags against their four-hour window and multiple-dose weight-loss vials against the 28 days the FDA advises.

The fourth is a store with routes. Every product carries one of five routes, cosmetic, over-the-counter drug, prescription, controlled substance or administered in the office, and the cart, the tax calculation and the pharmacy handoff all read it. Cosmetics ship and subscribe; prescriptions go to a pharmacy by e-prescription, or, for a practice with a dispensing permit, to an in-person pickup with the permit holder’s final check, a new prescription each time and the lot recorded against the patient. The memberships behind the store show the renewal price next to the consent, offer cancellation in the same place as sign-up, send Maryland’s renewal reminders on schedule, and keep the liability ledger per patient and per brand. Gift cards show the Attorney General’s notice, carry no fees for four years and never expire inside five. A visit booked through a free or discounted consultation offer carries the 72-hour window that the physicians’ advertising rule implies.

The fifth is a records layer with its own clocks. Photos are taken inside the system rather than on personal phones, tagged as clinical or marketing, and released for marketing only under an authorization that expires within a year and turns a revocation into a takedown task. Every disclosure goes into a log. Charts, consents, plans and photos carry a seven-year retention date, or the age of majority plus seven for minors, and a destruction workflow that sends the notice by e-mail or post and holds the records for 60 days. Patient requests for copies get two deadlines, Maryland’s 21 working days and HIPAA’s 30 calendar days where HIPAA applies, and a fee calculator. A switch records the first day the practice ran an electronic transaction with a health plan, the day HIPAA starts to apply to all of its records.

Around those five pieces sit the things every online business needs and that this trade’s platforms mostly leave out: service and price pages that name the brand, the unit and the credential of the person who treats; MedicalClinic and Offer markup; an llms.txt file; flags that keep prescription drug terms out of keyword targeting and patient lists out of ad audiences; and an export of everything a Board investigator would subpoena, appointment logs, staff credentials and product invoices, that can be produced in an afternoon.

Build, buy, or leave it alone

Most med spas should buy almost everything and build very little. The charting systems, booking platforms, payment processors and patient financing programs are mature products, and a single-location practice whose physician or nurse practitioner treats most patients personally, keeps a short menu, sells skincare in the treatment room and does not ship anything may have no problem this article can solve. A practice like that should choose its platform carefully, keep good habits and spend its money on staff, and we would say so on a call.

Choose vendors by the meter rather than the logo. Aesthetic Record charges per user, and per prescriber for e-prescribing; Mangomint counts everyone with a profile, front desk included; Jane counts practitioners and calls 24 booked hours a week full time; Boulevard and Square count locations; Vagaro counts bookable calendars. The card rates matter most, including the rate for a card kept on file, because in this trade they are the larger bill. Ask for the full price in writing, including setup, payment processing, e-prescribing and text messaging, what renews automatically and what the price becomes in year two, and then ask every vendor these questions before you sign:

• Can the online booking page tell a new patient from an assessed one, and refuse a treatment slot to a patient who has not yet been assessed by a physician or nurse practitioner?
• Can the schedule require a physician or nurse practitioner to be on site for the whole of a nurse’s or a delegated appointment, without booking them into it, and hide the slot when they are not?
• Can a nurse’s appointment be tied to a patient-specific order that names the area, the drug and the dose, rather than to a standing protocol?
• Are prices, packages and banked balances kept per brand of toxin, and can every vial be traced by lot from receipt to the patients it treated?
• Can the store keep prescription products out of the cart and send them to a pharmacy instead, and can marketing photos carry an authorization that expires?
• Who owns my patient records, photos and payment history, and can I export all of it, in full, whenever I like, including after I leave?

A vendor that answers all six well has earned the contract. Build when the honest answers are “the front desk handles that,” “we use a standing order” or “we would have to customize that” for the questions that carry your risk: when the schedule cannot see whether the prescriber is in the building, when new patients can book straight into injections online, when units are banked without a brand, or when the only record of which vial went into which patient is a sticker on a paper chart. Leave alone what is cheap and works: the charting system your injectors know, the payment processor, the financing partners, the manufacturers’ loyalty programs and the patients who have been coming back every three months for years.

Our guide to custom software in Baltimore explains how we work, our article on salons and spas covers the booking and retail side of the beauty trade, our article on beauty supply stores covers the cosmetics rules behind the skincare shelf, and our guide to Maryland’s privacy law covers the consumer data. If you want to find out which of these would pay for you, bring us an export of your service menu, a month of appointments with the providers on each, and your membership and package balances, and we will show you.

Questions med spa owners ask us

Can a nurse do Botox in Maryland?

Yes, with conditions. Under the Board of Nursing’s cosmetic procedures chapter, COMAR 10.27.25, a registered nurse or a licensed practical nurse may inject neurotoxins and dermal fillers, and a registered nurse may also perform laser treatments, but only on a completed prescriptive order for that patient that names the procedure, the treatment area and the medication, dosage, route and interval. Before the nurse treats, the prescriber, such as a physician or a nurse practitioner, must assess the patient, develop a treatment plan and be physically present in the setting and immediately available. Nurses may not work from standing orders or protocols.

Can an esthetician do laser hair removal or Botox in Maryland?

No. The Maryland Board of Cosmetologists’ 2026 scope guidance lists injectables, laser hair removal and IPL, radio frequency, HIFU, IV therapy and fat dissolving among services outside an esthetician’s scope, and says any service that penetrates beyond the epidermis is not permissible without a health-occupation license. Since 2024 Maryland law has allowed estheticians to perform cosmetic microneedling, which the Board’s regulations, revised effective March 2, 2026, limit to needles no longer than 1 mm that do not penetrate beyond the epidermis. The Board of Physicians’ cosmetic rules also do not allow a physician to delegate these procedures to anyone not licensed under the Health Occupations Article.

Does a med spa in Maryland need a medical director or a doctor on site?

It depends on who treats. A nurse practitioner in Maryland practices independently and may own and run a med spa without a physician. When a physician delegates or assigns cosmetic procedures, COMAR 10.32.09 requires the physician to personally perform each patient’s initial assessment, write a treatment plan naming the device and settings, and provide on-site supervision whenever a non-physician treats, except for physician assistants under the Board’s arrangements. When a nurse injects or uses a laser, the nursing chapter requires the prescriber who wrote the order, physician or nurse practitioner, to be physically present.

Can you convert Dysport units to Botox units?

Not according to the labels. Every FDA-approved botulinum toxin label says its units cannot be compared to or converted into the units of any other botulinum toxin product. The labeled doses for frown lines between the eyebrows are 20 units of Botox Cosmetic, Xeomin, Jeuveau or Letybo, 40 units of Daxxify and 50 units of Dysport. Conversion ratios found online come from studies and clinical practice, not from the labels, and a price per unit means something only next to the name of the brand.

How much does Botox cost per unit in Baltimore?

Of 52 Baltimore City and Baltimore County med spa websites we read on October 22, 2026, 11 published a price per unit of neurotoxin. Regular prices ranged from $12 to $14, with $13 the median, and member or new-patient prices went down to $10. Ten of the 11 used one price for two or more brands. At $13 a unit, the label dose for frown lines costs $260 with Botox Cosmetic, $520 with Daxxify and $650 with Dysport, so compare treatments, not units.

Can a med spa sell prescription skincare or Latisse online in Maryland?

Not by mail. A Maryland physician may dispense prescription drugs only with a Board of Physicians dispensing permit, which costs $1,050 for five years, requires the physician on the premises for a final check of each dispense and a patient-signed form, and forbids dispensing by mail order or by refill. Eyelash-growth drugs such as Latisse may be dispensed under a special $100 permit with one hour of continuing education a year. Prescription items sold online should be prescribed and filled by a pharmacy, which may ship them.

Is compounded semaglutide still legal in 2026?

Only in narrow circumstances. The FDA declared the tirzepatide shortage resolved in October and December 2024 and the semaglutide shortage resolved on February 21, 2025, and its grace periods for compounders ended in 2025. Pharmacies may no longer routinely make copies of the approved drugs, and in April 2026 the FDA proposed excluding semaglutide, tirzepatide and liraglutide from the list outsourcing facilities may compound from. The approved drugs are now sold directly to patients, with the Wegovy pill from $149 a month and Zepbound from $299 at the manufacturers’ self-pay prices.

Does HIPAA apply to a med spa?

Only if the practice conducts a covered electronic transaction with a health plan, such as a claim, an eligibility check or a prior authorization, including one typed into a payer’s web portal. A cash-only practice may fall outside HIPAA, but Maryland’s Confidentiality of Medical Records Act applies to every licensed provider and their employees whatever their billing, and the Board of Physicians’ cosmetic rule requires a delegating physician to keep records that comply with both the Maryland law and HIPAA.

How long must a Maryland med spa keep patient records and photos?

Seven years. Since October 1, 2024, Maryland Health-General §4-403 has barred a provider from destroying a medical record for seven years after it is made, or for a minor until the age of majority plus seven years, unless the patient is notified, and the records must be available for the patient to collect during the 60 days before destruction. Before-and-after photos entered in the chart, consent forms and treatment plans are part of the medical record.

Can a med spa advertise a free consultation in Maryland?

A physician’s advertisement may not offer discounted or free services, examinations or treatments if additional services are charged for as a result of, and within 72 hours of, the first visit made in response to the advertisement, except in a genuine emergency, under the Board of Physicians’ advertising rule, COMAR 10.32.01.13. The same rule requires an advertised fee to include the related procedures and products that will very likely be needed, and holds the physician responsible for advertising placed through an agent or business.

Can a med spa advertise Botox on Google?

Partly. Under Google’s healthcare and medicines policy, prescription drug terms such as Botox may appear in U.S. ad text and landing pages without certification, but advertisers must be certified to keyword-target them, and the certifications cover online pharmacies, telemedicine providers and drug manufacturers. Google also treats invasive procedures, including cosmetic surgery and injections, as a sensitive health category, so a med spa may not use its own customer lists, remarketing or lookalike audiences for those ads.

How much does med spa software cost in 2026?

On October 22, 2026, Aesthetic Record listed $15 or $19 per user a month plus a $399 setup fee, Boulevard’s med spa bundles were $364 or $416 per location a month on promotion against $455 and $520, Mangomint charged $120 per location plus $10 per user, and Jane charged from $79 a month plus $35 per additional full-time practitioner. PatientNow, Zenoti, Nextech and Symplast did not publish prices. In our model of a $1.6 million practice, card processing and financing cost about $44,800 a year, far more than any subscription.

How many med spas are there in Baltimore?

There is no official count, because med spas have no industry code of their own. Our census on October 22, 2026 found 59 locations of 56 businesses offering neurotoxin injections or medical lasers in Baltimore City and Baltimore County, 10 of them in the City and 49 in the County, concentrated in Lutherville-Timonium, Towson, Owings Mills and Hunt Valley. At the national density in the American Med Spa Association’s count, the two jurisdictions would have about 44, or about 54 using a higher 2026 estimate of 13,000 med spas nationwide.

Should a Baltimore med spa build custom software?

Usually not all of it. Keep the charting system, payment processor and financing partners that work, and build only the layer your platform cannot provide: an assessment-first booking flow, a schedule that knows whether the prescriber is on site, units and vials tracked by brand and lot, a store that routes prescriptions to a pharmacy, and records with Maryland’s retention and authorization clocks. Our fixed-price Online Store package starts at $6,000 and a Custom App at $12,000, before Maryland’s 3% tax on software and IT services.