Clinic Marketing and Growth
CASL-Compliant Email Marketing for Medical Spas
Email marketing for medical spas that complies with CASL: consent, identification, unsubscribes, and records — plus email ideas clients actually want to read.

Key takeaways
- CASL requires consent, sender identification, and a working unsubscribe for commercial electronic messages.
- Express consent is the strongest foundation; implied consent exists but expires.
- Keep a record of how and when each person consented — you may need to prove it.
- Useful, educational emails sent to people who asked for them outperform blasts to everyone.
Email is one of the most cost-effective ways for a clinic to stay in touch with clients — but in Canada it comes with specific legal requirements. This guide explains email marketing for medical spas that complies with CASL, Canada's anti-spam legislation, and how to build a med spa email marketing program that clients welcome rather than delete.
It's a practical overview, not legal advice. CASL has detailed rules and exceptions, so have your consent wording and processes reviewed by an adviser, and use the official guidance from the government and the CRTC.
What CASL covers
Canada's anti-spam legislation (CASL) (opens in a new tab) applies to commercial electronic messages — emails, texts, and similar messages that encourage participation in a commercial activity. For a med spa, that includes newsletters with offers, promotions for services, announcements of new treatments, membership invitations, and most "we miss you" messages.
In general, sending a commercial electronic message requires three things:
- Consent from the recipient, either express or implied.
- Identification of the sender — your clinic's name and contact information, including a mailing address.
- An unsubscribe mechanism that's easy to use.
The CRTC's frequently asked questions about CASL (opens in a new tab) are a good plain-language reference for these requirements.
Express vs implied consent
Express consent
Express consent is when someone actively agrees to receive your marketing messages — for example, by ticking an unticked box on your booking form or newsletter sign-up that clearly says what they're agreeing to. It doesn't expire unless the person withdraws it, which makes it the best foundation for a clinic email list.
A clear consent request
- Uses an unticked checkbox or similar active step — never a pre-ticked box.
- Is separate from agreeing to your terms or booking an appointment.
- Says what kinds of messages the person will receive.
- Names your clinic and explains how to contact you.
- Tells the person they can withdraw consent at any time.
Implied consent
CASL also recognizes implied consent in certain situations, such as an existing business relationship. In broad terms, a client who bought a service from you has implied consent for a period after the purchase, and someone who made an enquiry has it for a shorter period. Implied consent expires, so it's a fragile basis for a long-term list. Check the exact periods and conditions in the official guidance, and use your contact with clients to ask for express consent.
Identification and unsubscribe requirements
Every commercial email should clearly identify your clinic and include a working unsubscribe link. In practice, that means:
- Your clinic's business name and a mailing address in the footer.
- At least one other way to contact you, such as a phone number, email address, or website.
- An unsubscribe link that works without logging in or calling the clinic.
- Unsubscribe requests processed promptly — CASL sets a maximum period, so check the guidance and aim to act immediately.
Keep transactional and marketing messages separate
Appointment confirmations and reminders are generally treated differently from promotional messages. That distinction disappears if you add offers to them. Keep reminders focused on the appointment, and send marketing through your consented list.
There's a privacy angle too. Avoid naming sensitive treatments in subject lines or text messages that may appear on a lock screen or shared device. Clients choose clinics partly on discretion.
Keep consent records you can rely on
If a complaint arises, the sender is generally expected to show that consent was obtained. Records should be part of your system, not an afterthought.
What to record for each contact
- Whether consent is express or implied.
- When it was given, and how (online form, intake form, in person).
- The wording the person agreed to.
- For implied consent, the purchase or enquiry date that it's based on.
- Any withdrawal, and when it was processed.
Collecting and storing this information also falls under privacy law. The Office of the Privacy Commissioner's overview of PIPEDA (opens in a new tab) explains the general principles; Ontario clinics handling personal health information should also consider PHIPA. Our guide to moving to digital intake and consent forms covers capturing consent at intake.
Building your med spa email list the right way
A smaller list of people who chose to hear from you is worth far more than a large list of contacts who never asked. Build consent into the moments when clients are already engaged with your clinic.
- Online booking: add an optional, unticked box inviting clients to receive clinic news and offers.
- Digital intake forms: include the same optional consent question, worded clearly and kept separate from treatment consent.
- Website sign-up: offer a newsletter with a short description of what subscribers will receive and how often.
- At the front desk: if a client asks to hear about events or new services, record their consent in their file at that moment, noting how it was given.
- Events: use a sign-up sheet or form with clear consent wording, not a bowl of business cards.
Tell people what to expect, then stick to it. If you promise a monthly newsletter, don't start sending weekly promotions. Clients who get what they signed up for are less likely to unsubscribe or mark your emails as spam.
Med spa email marketing ideas clients want to read
Compliance gets your emails delivered legally; usefulness gets them opened. The best clinic emails feel like helpful notes from a trusted practitioner.
- Welcome email for new subscribers: who you are, who treats clients, and how to book a consultation.
- Monthly or seasonal newsletter: skin care tips reviewed by your clinical lead, clinic news, and new team members.
- Treatment-timed rebooking messages: a friendly note when a client is typically due for their next visit — to clients with consent on file.
- Membership and package updates for clients who've shown interest.
- Referral program announcements explaining how clients can recommend friends.
- Event invitations for educational evenings.
How software can help
Managing consent by hand in a spreadsheet gets risky as your list grows. In MedClinora, marketing automation sends only to clients with recorded consent and includes an unsubscribe link, while appointment reminders stay separate. Client records keep consent details alongside each profile, and digital forms can capture consent at intake. See the features page for details.
Do appointment reminders need CASL consent?
Messages that only confirm or remind someone about an appointment they booked are generally treated differently from promotional messages. Once you add offers or promotions, treat the message as marketing. Check the CRTC and government guidance for the specific exemptions.
How long does implied consent last under CASL?
It depends on the basis for it. For an existing business relationship, implied consent lasts for a limited period after a purchase or enquiry. Check the exact periods in the official guidance, and ask clients for express consent so you don't depend on it.
Can I email clients who gave me their address at intake?
Having an email address isn't the same as having consent to send marketing. If they ticked a clear, separate box agreeing to receive marketing, you have express consent. Otherwise, check whether implied consent applies and how long it lasts.
What happens if a med spa breaks CASL?
CASL is enforced by the CRTC and can involve significant penalties. Beyond legal risk, unwanted emails damage trust. Build consent, identification, and unsubscribes into your process from the start.
Email marketing works well for med spas when it's built on clear consent and genuinely useful content. Get the consent wording right, keep good records, separate reminders from promotions, and send emails people want to open. For more growth ideas, read 25 medical spa marketing ideas that follow the rules and how to run a referral program for a medical spa.
Sources and further reading
- Innovation, Science and Economic Development Canada — Canada's anti-spam legislation (opens in a new tab)
- CRTC — Frequently asked questions about Canada's anti-spam legislation (opens in a new tab)
- Office of the Privacy Commissioner of Canada — PIPEDA (opens in a new tab)
- Health Canada — Illegal marketing of prescription drugs (opens in a new tab)
General information only. This article is educational and isn’t legal, tax, financial, or clinical advice. Requirements depend on your province, your professional college, your role, and the treatments you offer — confirm them with the relevant regulator or a qualified adviser.


