Medical Spa Operating System

1. Scope of practice and oversight

In Ontario, procedures such as injecting a substance below the dermis and certain energy-based treatments are controlled acts. They may only be performed by an authorized regulated health professional, or by a competent person under a valid delegation with documented supervision. Build your service menu around this before you advertise anything.

• · Service menu with the responsible regulated professional named for each treatment
• · Written medical directives or delegations signed and dated by the delegating physician or nurse practitioner, with review dates
• · Competency assessment and training file for every person performing delegated acts
• · Professional liability insurance for each practitioner and the clinic
• · Emergency protocols, including anaphylaxis and hyaluronidase availability where dermal fillers are used

2. Client intake and informed consent

• · Health history: medications, allergies, autoimmune conditions, pregnancy or breastfeeding, prior treatments, implants
• · Contraindication screening documented and signed before every treatment, not just the first
• · Informed consent covering the nature of the treatment, expected results, alternatives, material risks and side effects, aftercare and cost
• · Separate written consent for photography and any use of images in marketing, revocable at any time
• · Cooling-off and cancellation terms disclosed in writing before payment (Consumer Protection Act, 2002 applies to prepaid services and packages)

3. Clinical record standard (PHIPA)

• · One record per client containing intake, consents, treatment notes, product lot numbers and expiry, injector, dose/settings, and aftercare given
• · Records retained at least 10 years after the last interaction (and, for a minor, 10 years after the client turns 18) — follow your regulator's rule where it is longer
• · Named Privacy Officer, written privacy policy and posted notice of information practices
• · Access controls, audit logs, encryption at rest and in transit, and a signed confidentiality agreement for every employee
• · Privacy breach procedure: contain, investigate, notify the individual at the first reasonable opportunity and notify the Information and Privacy Commissioner of Ontario where required

4. Infection prevention and control

• · Hand hygiene at the four moments; alcohol-based rub at every station
• · Single-use needles and cannulas; no reuse, no multi-client vials without documented safe practice
• · Sharps containers, biomedical waste contract and disposal manifests
• · Reprocessing of reusable instruments per CSA standards with a sterilizer log, chemical and biological indicators recorded weekly
• · Surface disinfection between clients with a Health Canada registered disinfectant used at the labelled contact time
• · Linen handling, treatment room cleaning schedule and annual IPAC self-audit

5. Product handling

• · Only Health Canada authorized products with a DIN, NPN or medical device licence — record the licence number
• · Purchase from authorized Canadian distributors only; retain invoices
• · Cold chain log for refrigerated products with twice-daily temperature records
• · Lot number and expiry recorded in the client chart for every injectable
• · Recall procedure and Health Canada adverse reaction reporting

6. Advertising and pricing rules

• · No testimonials or endorsements for regulated services where your regulator prohibits them — check CPSO and CNO advertising standards before publishing reviews
• · No comparative or superlative claims that cannot be substantiated (Competition Act, sections on misleading representations)
• · Prescription drug advertising restrictions apply to products such as botulinum toxin — do not name or price them in public advertising
• · Before/after images must be unaltered, consented, and labelled with typical results and treatment count
• · All-in pricing, package terms, expiry and refund policy disclosed before payment

7. Staff, safety and training

• · Annual competency review and documented CPR/first aid certification for clinical staff
• · OHSA workplace violence and harassment programs, WHMIS training, laser safety officer where Class 3B/4 devices are used
• · Laser safety: controlled access signage, eyewear rated to the wavelength, device service log
• · Incident and adverse event register with root cause review and corrective action

8. Business performance dashboard