CosignMD

Idea

Compliance software that proves a med spa's medical director is actually doing the job, not just signing a contract. CosignMD gives medical directors a review queue to co-sign charts and protocols within the state-required window, logs required site visits, version-controls standing orders, and exports an inspection-ready compliance binder on demand. It sells to med spa owners and MSOs who are watching state regulators tighten enforcement fast, and who have no software built specifically to prove oversight is real rather than "ghost."

Market gap

Every med spa management platform on the market (Pabau, Aesthetic Record, Boulevard, Vagaro, Meevo, AestheticsPro, Zenoti) is a booking, POS, and EMR system with a generic HIPAA audit log bolted on. None of them are built around the specific artifact regulators are now asking for: proof that a named medical director reviewed specific charts, visited the site on a schedule, and kept standing orders current. The other camp, MedSpa Standards and similar consultancies, sells static SOP and protocol templates and one-time consulting. Nobody sells the ongoing workflow layer that generates the timestamped evidence trail itself.

Timing is why this matters now. New York's Department of State ran a statewide sweep, announced January 8, 2026, that inspected 223 med spas and cited 87 of them, largely for unlawful practice of medicine and inadequate oversight. NYC's own Inspector General inspected 15 med spas (report released December 2025) and found 73% lacked medical oversight during procedures and 100% were offering medical services without required licensure; four locations already lost their licenses. Investigators are explicitly checking for "ghost medical directors," directors who are nominal or remote and can't produce chart-review logs or site-visit records when asked. On top of state health department enforcement, California's SB 351, effective January 1, 2026, bars MSOs and PE-backed management companies from controlling clinical decisions, which pushes owners toward documenting that their physician, not their management company, is making the calls. The AMA reports 36 states still have no med spa-specific regulatory framework at all, which means the compliance bar is inconsistent and rising unevenly, exactly the kind of environment where owners want a system doing the tracking for them instead of a binder in a drawer.

Total Addressable Market (TAM)

Bottom-up, from the demand side:

• US med spa location count: approximately 11,000 locations (American Med Spa Association industry data, cited via AestheticHires' 2026 industry statistics compilation).
• Realistic annual contract value: average med spa revenue runs $1.6M to $2.8M a year per AmSpa data, so a $299 to $799/month compliance subscription ($3,600 to $9,600/year) is a small, defensible line item next to existing $400 to $1,000/month EMR/booking software spend. Using a blended realistic ACV of $3,600/year (entry tier, since most operators are single-location):
• TAM = 11,000 locations x $3,600 = $39.6M/year.

SAM: 81% of med spas are single-location (AmSpa), but multi-location groups and MSOs are the more urgent buyer given SB 351 and enforcement patterns, and single-state-specific launch (NY, CA, TX, FL cover a large share of both med spa density and active enforcement). Estimating 55% of the 11,000 locations sit in these four launch states or in multi-location groups likely to expand there = 6,050 locations x $3,600 = $21.8M SAM.

SOM: Realistic 18-month capture at 3% of SAM = roughly 180 locations x $3,600 = $648K ARR, achievable through direct outreach to MSOs (which buy in blocks of locations, not one at a time) and a free lead-generation tool driving inbound single-location signups.

Monetization strategy

Per-location monthly SaaS subscription, sold to the med spa owner or MSO who bears the compliance and license risk. Medical directors get a free reviewer seat since they are frequently part-time or contracted across multiple locations and are not the buyer, but they are the daily user whose adoption makes the compliance record real. MSOs buying in bulk get a volume discount per location, which fits how they already buy EMR and payroll software. Revenue is sticky because the compliance binder becomes the operator's evidence file for license renewals and any future inspection, and churning means losing the audit history right when regulators are most active.

Pricing strategy

• Starter ($299/month): single location, up to 3 injectors, one medical director seat, standard state rule pack, monthly compliance binder export.
• Growth ($799/month): up to 5 locations under one org, unlimited injectors, org-level risk dashboard across locations, on-demand binder export.
• MSO / Enterprise (starting at $1,999/month): 6+ locations, multi-state rule packs, CSV import from existing EMR/booking exports, priority support for inspection response.

Anchor is the MSO tier, since MSOs are the ones most exposed under SB 351-style laws and buy in blocks. Entry point is Starter, priced under half of what most locations already pay for EMR/booking software, so it reads as an add-on, not a replacement purchase.

Lead magnet

A free, interactive "50-State Med Spa Medical Director Oversight Tracker": a lookup tool where an owner selects their state and gets the actual chart-review cadence, site-visit frequency, and delegation rules that apply to them, pulled from the same curated rule set the product runs on. Med spa regulation is a genuine 50-state patchwork with no single authoritative public summary, so this tool solves a real, immediate research problem for free and puts the ideal buyer (anxious about a specific state's rules) directly in front of the product that automates what the tracker just described.

Social proof that the problem exists

1. New York Department of State press release, January 8, 2026: a statewide task force inspected 223 med spas and cited 87 for violations including unlawful practice of medicine, with documented patient injury cases (MRSA, sepsis, hospitalization) tied to inadequate oversight. https://dos.ny.gov/news/new-york-department-state-issues-warning-consumers-after-investigations-med-spa-service
2. New York City Council press release, December 11, 2025: a joint Inspector General investigation of 15 NYC med spas found 100% offered medical services without required licensure and 73% lacked medical oversight during procedures; four locations have already had licenses revoked. https://council.nyc.gov/press/2025/12/11/3027/
3. American Medical Association report: 36 states have no med spa-specific regulations at all, meaning oversight requirements are inconsistent and rapidly evolving state by state, the exact condition that makes owners want automated tracking instead of manual compliance calendars. https://www.ama-assn.org/practice-management/scope-practice/36-states-lack-regulatory-oversight-med-spas
4. Legal industry coverage of the NY sweep names the specific failure mode this product targets: a medical director who "never visits and reviews zero charts" is the textbook "ghost" finding, and inspectors now ask on the spot for chart-review logs, site-visit records, and protocol approvals. https://medspire-health.com/blog/new-york-med-spa-sweep-223-inspections-87-violations/
5. Multiple law firms (Jackson LLP, Lengea Law, and others) published detailed 2025-2026 guidance on California's SB 351, effective January 1, 2026, which bars MSOs and private equity-backed management companies from controlling clinical decisions in physician-owned practices, directly increasing the compliance-documentation burden on med spa MSOs. https://jacksonllp.com/california-msos-new-requirements-coming-for-2026/

Competitors

• Pabau (pabau.com): full aesthetic clinic management suite (booking, POS, EMR, marketing) with a general HIPAA compliance mode, audit logs, and digital consent forms, but no medical-director-specific oversight workflow.
• Aesthetic Record (aestheticrecord.com): EMR and booking platform for med spas with HIPAA-centered documentation; compliance features stop at patient-record audit trails, not scope-of-practice or medical-director sign-off tracking.
• Boulevard (joinblvd.com): booking, POS, and client experience platform for med spas and salons; not built around regulatory oversight documentation.
• Vagaro, Meevo, AestheticsPro, Zenoti: general spa/med spa management software (scheduling, POS, marketing, basic HIPAA logging); compliance is a checkbox feature, not the product.
• MedSpa Standards (medspastandards.com): sells static SOP and protocol document templates and compliance consulting; a one-time or periodic purchase, not an ongoing software system that generates a live evidence trail.

What competitors offer now

Booking/EMR platforms give owners a scheduling calendar, a POS, marketing tools, and a patient-record system with a generic access-log audit trail sufficient for HIPAA but not for proving scope-of-practice compliance. None of them track which specific charts a named medical director has reviewed and signed within a state-mandated window, none log required site visits, and none version-control standing orders against the date of the last relevant state regulatory change. MedSpa Standards and similar consultancies hand over a PDF binder of protocols once, which goes stale the moment a law changes or a new injector is hired, with no system tracking whether staff have actually been trained on the current version.

What can be done differently to attract customers

Lead with the exact language regulators are using right now ("ghost medical director," chart-review logs, site-visit records) instead of generic "compliance software" positioning, since owners and MSOs are actively searching for and reading about these specific enforcement actions. The free 50-state oversight tracker earns organic search traffic and legal-newsletter mentions (law firms are already writing about this weekly) well before a paid product exists. Sell first to MSOs and multi-location groups, who buy compliance tooling in blocks across locations and are the direct target of laws like SB 351, then let single-location owners self-serve in through the free tracker and Starter tier. Partner with med spa-focused insurance brokers and malpractice carriers, who have a direct financial interest in fewer claims tied to undocumented oversight and are a distribution channel none of the booking-platform competitors have reason to pursue.

Initial MVP scope

In scope:

• Multi-tenant org and location setup, with medical director and injector/provider assignment per location
• Standing order/protocol library per location with version history and staff training attestation
• Chart/procedure log entry (manual or CSV import from existing EMR/booking exports)
• Medical director review queue with digital signature and timestamped co-sign
• Per-state compliance calendar (chart-review cadence, site-visit frequency) with overdue flags, launching with New York, California, Texas, and Florida rule sets
• Site-visit logging
• A compliance-monitoring agent that flags missing co-signs, stale protocol versions, and approaching or missed deadlines on an org-level risk dashboard
• One-click, date-ranged, inspection-ready compliance binder PDF export
• Stripe billing per location, admin portal for org owners

Out of scope:

• Native scheduling, POS, marketing, or inventory features (this is a compliance layer, not an EMR/booking replacement)
• Direct API integrations with existing EMR/booking platforms beyond CSV import
• Patient-facing portal or communications
• Auto-drafting of standing orders or state-specific legal advice generation
• States beyond the initial four at launch
• Mobile app