For medspas & clinics · Early access

A practice runs on connections,
not modules.

Salon software with a consent form bolted on is not clinical software. Plexon puts the consult, the consent, the chart, the photos, and the follow-up on one client record, with the compliance work done in the foundation.

Request early access

Built HIPAA-ready from the first table, not retrofitted

The day-one clinical set

Five things a medspa cannot legally or safely run a day without. Most platforms treat them as add-ons. Here they are the spine.

Consents

Versioned, signed, kept

Per-treatment consent templates with version history. E-sign at every visit, snapshot of the exact text signed, photo-marketing authorization as its own distinct consent. Retained the full six years.

Good Faith Exams

Gating, not a checkbox

Booking and treatment are blocked without a current GFE. Validity windows are configurable per state, telehealth GFEs ride the built-in video visit, and only qualifying provider roles can perform one.

Charting

Notes that hold up

SOAP-style notes with treatment templates for tox, filler, laser, and microneedling. Injection-site diagrams record zones and units per site. Charts lock after signoff.

Photo vault

Before & after, guarded

Progress photos live in a private vault with signed, expiring access and an audit log of every view. Marketing use is tied to the client's actual authorization, not a folder naming convention.

Deposits

No-shows stop being free

Deposit at booking and card-on-file no-show fees, the industry norm for injectables, built into the same billing that runs memberships and packages.

Consult pipeline

From inquiry to treatment plan

The same CRM that fills gyms fills consult calendars: lead, consult, treatment plan, won. Recall campaigns bring clients back when their results fade on schedule.

The foundation

Compliance you can show an auditor

Most platforms describe their security in adjectives. Ours is a list of mechanisms, because it is built into the database itself.

Audit trail Append-only audit log on every clinical and financial table. Who changed what, when, from which account. Attempts to alter the log are blocked and themselves recorded.

Data classification Every table and column is classified (PHI, PII, financial, operational), so access rules and exports know exactly what they are handling.

Retention Six-year clinical retention and seven-year financial retention tracked per record class. Nothing silently deleted, nothing kept forever by accident.

Right of access A client's complete record exports as one bundle on request, with the disclosure itself logged. HIPAA gives you 30 days; this takes one click.

Access control Row-level security per location, role-based permissions, and idle-session logoff. A provider sees their clients; the front desk sees arrival status, not charts.

Business associate agreements are executed with infrastructure partners before any live client data is handled

The hybrid future

Your gym is becoming a clinic.
Your clinic, a membership.

38% of US medspas now run GLP-1 weight-loss programs. Gyms are adding IV therapy, hormone panels, and recovery services. The businesses are converging; the software hasn't.

✓One record across both registers. The same person who lifts on Tuesday gets tox on Thursday. Their membership, packages, charts, and photos live together.
✓Banked-credit memberships for treatments, on the same ledger that runs class packs. Recurring revenue for the clinic side.
✓Per-location configuration. A gym location, a clinic location, and a hybrid location can share one account and one brand.

Arrivals · Belleza Aesthetics Today

Maya Reyes · Tox, 3 areas

Consent signed · GFE valid to Nov 12

Ready

Lena Brooks · Filler consult

GFE expired Aug 2 · telehealth slot offered

GFE needed

Dana Kim · Laser, session 3 of 6

Package credit · deposit on file

Arrived

▸ Lena's GFE lapsed. Booking is held until a provider completes a new exam. A telehealth slot is one tap away.

A practice runs on connections,not modules.