Spa Intake Forms: What to Ask, Store and Never Lose

Picture a client arriving for a deep-tissue massage. The front desk hands over a clipboard: four pages in tiny print, including questions nobody will ever read. She rushes through, skips the allergy section, signs the consent paragraph without reading it, and the card goes into a drawer behind reception.

Six months later, a therapist is about to start a hot-stone treatment. The client had a cardiac procedure since her last visit, but nobody can find the card, and nobody thought to ask.

That's a hypothetical, but it's the predictable result of treating the intake form as a formality. It's actually three things at once: a safety gate, a personalisation tool and a legal record.

The short answer: A spa intake form should capture contact details, health flags relevant to the booked treatment, informed consent for that treatment, and separate opt-ins for photos and marketing. Nothing else. Aim for something a client finishes in a few minutes and a therapist reviews in under two, stored in spa management software so it stays attached to the client's profile.

Step 1: Decide what the form is for before you design it

Most form problems start here. Someone opens a template, adds every question they can think of, and calls it done.

Stop. Your spa intake form has three jobs:

• Safety: flag conditions that could make a treatment unsuitable.

• Personalisation: capture preferences and goals so the therapist can adapt.

• Record: a dated, retrievable document showing what the client disclosed and consented to.

If a field doesn't serve one of those three, cut it. "How did you hear about us?" is useful to marketing, but it belongs at the end or in a post-visit survey, not in the middle of health screening.

Visual checkpoint: your form outline fits into three sections (safety, personalisation, record), and every question traces back to one of them.

Step 2: Choose fields by treatment type

One universal form for every service is a common shortcut and a bad one. A sauna client doesn't need questions about retinoids. A chemical peel client absolutely does.

A minimum field set by treatment (add to it for your menu; don't subtract):

• Pregnancy or breastfeeding — Massage: Yes · Facial: Yes · Body treatment: Yes · Sauna / cold plunge: Yes

• Blood pressure concerns — Massage: Yes · Facial: Yes · Body treatment: Yes · Sauna / cold plunge: Yes

• Surgery in the last 6 months — Massage: Yes · Facial: Yes · Body treatment: Yes · Sauna / cold plunge: Yes

• Heart or circulation condition — Massage: Yes · Facial: Optional · Body treatment: Optional · Sauna / cold plunge: Yes

• Current medications — Massage: Yes · Facial: Yes · Body treatment: Yes · Sauna / cold plunge: Yes

• Allergies (products, oils, nuts) — Massage: Yes · Facial: Yes · Body treatment: Yes · Sauna / cold plunge: Optional

• Skin conditions or sensitivities — Massage: Optional · Facial: Yes · Body treatment: Yes · Sauna / cold plunge: Optional

• Retinoid or exfoliant use — Massage: No · Facial: Yes · Body treatment: Yes · Sauna / cold plunge: No

• Cold-sore history — Massage: No · Facial: Yes · Body treatment: No · Sauna / cold plunge: No

• Recent sun exposure — Massage: No · Facial: Yes · Body treatment: Yes · Sauna / cold plunge: No

Frame every health question as a flag for the therapist to discuss, never a diagnosis. The form is a screening prompt; the therapist follows up in person.

If your spa management software supports conditional logic, use it so clients only see questions for the service they booked. A facial client sees the retinoid and cold-sore questions; a massage client doesn't. Shorter forms get finished.

Visual checkpoint: every service on your menu maps to a defined field set. No service without intake logic.

Step 3: Write consent that actually protects you

A completed spa consultation form isn't the same as informed consent. Treat them as separate sections with separate confirmations.

Treatment consent should say what the treatment involves, known risks and side effects, aftercare responsibilities, and the client's right to stop at any time. Use plain language. If a client can't understand it without help, rewrite it.

Photo consent and marketing opt-in must be separate from treatment consent. Agreeing to a facial isn't agreeing to appear on your Instagram. Use distinct checkboxes, and say whether photos are for internal records, marketing or both.

For treatments with session-specific risk (peels, dermaplaning and similar), consider re-confirming consent at every session rather than relying on one signature from months ago.

What the law expects (not legal advice)

• India: the Digital Personal Data Protection Rules were notified in November 2025. Penalty provisions start on 13 November 2026 and full compliance is due by 13 May 2027. The DPDP Act 2023 allows penalties of up to ₹250 crore for failing to take reasonable security safeguards. Our explainer on the DPDP Act covers what it means for client data.

• UAE: the Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) makes consent the main legal basis for processing personal data. Health data is largely governed by separate health-sector rules, so DHA- or DOH-licensed facilities should confirm requirements with their regulator.

The direction is clear either way: careless consent capture is getting expensive. Confirm specifics with your legal advisor.

Step 4: Set an update cadence staff will actually follow

A form signed two years ago is close to useless. Medications change. Pregnancies and surgeries happen.

Build two rhythms:

1. Every visit, 30 seconds: "Has anything changed since last time? New medications, surgery, skin reactions?" The therapist either ticks "confirmed, no changes" or updates the record.

2. Once a year: the client reviews and re-confirms the full form.

Visual checkpoint: before each session, the therapist can see the date of the last full review and the last quick check.

Step 5: Collect less, on purpose

Don't collect what you won't use. Every stored field is a field you must protect, and both India's DPDP framework and the UAE's PDPL push toward data minimisation.

If nobody ever reads "How did you hear about us?", move it to a feedback survey. If you collect date of birth only for birthday offers, make it optional and keep it apart from health information. Lean, well-kept client profiles beat fifty fields nobody reads.

Step 6: Control who sees what

Your receptionist needs contact details and booking preferences. Your therapist needs health flags and treatment history. Your marketing lead needs consent status. None of them needs everything.

Set role-based access. Many of the compliance risks spa managers overlook start right here: when everyone can see every field, nobody treats any of it as sensitive.

Step 7: Move from paper to digital

The Ugly Truth about paper intake cards

• Cards go missing — Fix: Store forms digitally on the client profile · Why it happens: Overflowing drawers, misfiling, staff turnover

• Therapists can't read the handwriting — Fix: Typed digital forms with required fields · Why it happens: Rushed clients, no standard format

• No proof of when consent was given — Fix: Digital confirmation with an automatic timestamp · Why it happens: Paper has no audit trail

• Branch B can't see Branch A's forms — Fix: Central cloud storage across locations · Why it happens: Paper stays where it was filed

• Old forms never get updated — Fix: Automatic review reminders · Why it happens: Nothing triggers a review

Send the form before the appointment, with a gentle reminder a few hours before if it's still incomplete. That clears most stragglers without jamming the front desk.

Done well, digital intake looks like this: the front desk opens one client profile and sees intake, consent, appointment history and notes together. No chasing PDFs or WhatsApp photos of paper forms. When you evaluate platforms, look for digital intake forms that feed straight into the client record without re-typing.

This is often the moment owners realise why spa management software is important. The intake data exists somewhere; nobody can find it when the therapist needs it.

When this guide isn't enough

If you run a medically licensed facility (injectables, laser, IV therapy), a general spa intake form won't cover you. You need clinical documentation, practitioner-specific consent and medical-record rules beyond this guide. In the UAE that means working with your DHA or DOH requirements; in India, the medical and state regulations that apply to clinics; in the US, HIPAA where applicable. Work with a healthcare compliance adviser. This guide is for day spas, wellness centres and non-medical skin studios.

FAQs

What should a spa intake form include?

Contact and emergency details; health flags such as allergies, medications, pregnancy, recent surgery, skin conditions and blood pressure; questions specific to the booked treatment; informed consent for that treatment; and separate opt-ins for photos and marketing. Leave out anything your team never reviews, because every extra field is data you must protect.

How long should a spa keep intake forms?

There's no single retention period that applies to every spa. Keep records as long as you genuinely need them, for example to cover the period in which a client could raise a complaint or claim in your jurisdiction, store them securely, and delete them when that purpose ends. This isn't legal advice, so confirm the period with your adviser.

Can I use WhatsApp to collect intake forms?

WhatsApp is convenient but a poor home for intake data. Chats are hard to search, easy to lose and don't sit on a structured client record. A workable middle ground is sending a form link over WhatsApp that submits straight into your booking system. WhatsApp becomes the delivery channel; the record lives where your team can find it.

Do I need separate consent for photos?

Yes. Treatment consent and photo consent cover different things. A client who agrees to a facial hasn't agreed to before-and-after photos on social media. Capture photo consent with its own checkbox, state whether images are for internal records, marketing or both, and make it easy for clients to withdraw that consent later.

If your intake still lives on paper or in WhatsApp photos, it's one of the easiest parts of your operation to fix. Whether you run a spa or a beauty clinic, book a free DINGG demo to see DINGG's digital forms and client profiles live, and ask our team anything about how they would fit your workflow.