In the local SEO playbook, the review advice was simple: ask everyone, right after the moment of value, never incentivize, never gate. That advice holds for a restaurant or an HVAC company. It gets genuinely more complicated for a med-spa or a law firm, because both operate under privacy and professional-conduct constraints that a generic "text every customer a review link" playbook does not account for. This is the version we actually run for clients in those two niches, and the caveats matter more than the tactics.
Standard note before any of this: none of the following is legal advice. Medical practices should confirm HIPAA-adjacent review practices with their compliance counsel, and attorneys should check their specific state bar's advertising rules before running any review program, since these vary by state and change periodically. What follows is the general shape we have seen work within those constraints, not a substitute for checking your own.
Reviews still matter as much in these niches, arguably more
None of the constraints below are a reason to skip review generation — if anything, trust signals matter more in these two niches than almost any other category we work in. Someone choosing a med-spa is trusting a provider with their body and their money on an elective procedure with real technique variance between practitioners. Someone choosing a personal-injury or family-law attorney is often making that decision during one of the worse weeks of their life, with limited ability to evaluate legal skill directly. Reviews are doing more trust-building work here than they are for a restaurant choice, which is exactly why it is worth doing the constrained version properly instead of skipping the whole effort out of caution.
Why the generic playbook breaks here
A generic review ask ties the request to the specific service performed — "thanks for the AC repair, mind leaving a review?" — which works fine for home services and is actively risky for a med-spa or law firm to phrase the same way. A public review that names a treatment, a diagnosis, or a legal matter can create a privacy exposure for the patient or client that has nothing to do with the business's intent, and in some states, attorney advertising rules specifically restrict testimonials that reference case outcomes or imply a predictable result. The ask has to be worded to invite a review of the experience, not the specifics of what was treated or litigated.
The med-spa version
Never reference the treatment in the ask. A follow-up text reading "how did your Botox appointment go, mind leaving a review?" puts a specific treatment in writing tied to the client's name and phone number, which is exactly the kind of detail a HIPAA-conscious practice should avoid generating unnecessarily, even in an outbound message the practice itself controls. "Thanks for visiting us this week — we'd love to hear about your experience" gets the same review with none of the exposure.
Separate review consent from photo consent. Before-and-after photography is a powerful marketing asset for med-spas, but it requires its own explicit written consent, entirely separate from whether a client is willing to leave a public review. Bundling the two into one ask — implicitly or explicitly — muddies both and can pressure a client into agreeing to more than they intended.
Time the ask to the portal, not the front desk. A message sent through the patient portal or a scheduled post-visit text a day or two later, once results have started to show, consistently outperforms an ask made at checkout while the client is still numb from a procedure and thinking about getting home, not about writing a review.
The law firm version
Ask about the experience, not the result. "They fought hard for me and settled for more than I expected" is a testimonial about outcome, and several state bars restrict or require disclaimers on exactly that kind of language because it can read as an implied promise of results to future clients. "They kept me informed at every step and explained things clearly" is a testimonial about service, and it is both a stronger trust signal for someone evaluating a firm and far less likely to run into an advertising-rule problem.
Confirm your specific state's rules before scripting anything. California, where most of our clients practice, has its own advertising rules under the State Bar Act, and firms with multi-state practices need to check each jurisdiction independently rather than assuming one script is safe everywhere. This is genuinely the one place in local SEO where "check with a professional" is not boilerplate caution — it is the actual first step.
Time the ask after resolution, framed around the relationship. Once a matter closes, a message thanking the client for trusting the firm and inviting them to share their experience — again, experience, not outcome — respects both the professional-conduct rules and the reality that most clients are relieved a matter is over and genuinely willing to say something kind about the process if asked promptly.
The anonymized-review trap
A workaround we see practices reach for, thinking it solves the privacy problem: posting or encouraging reviews under initials only, or asking a client to leave a review through a business-controlled account rather than their own. Neither actually solves anything. A review that reads as clearly fabricated or business-authored — generic phrasing, posted in a suspicious burst, missing the specific texture a real client's own words tend to have — is exactly the pattern Google's spam detection has gotten good at catching, and getting caught risks the whole profile, not just the one review. Genuine consent from the actual reviewer, posted through their own account, in their own words, is not a workaround-able step. It is the entire foundation the rest of this playbook sits on.
Diversify past Google, deliberately
Google reviews still matter most for map pack visibility, but both niches have industry-specific platforms that carry real weight with the people actually comparing providers: Healthgrades and RealSelf for med-spas and aesthetic practices, Avvo and Martindale-Hubbell for attorneys. A prospective client comparing law firms is often reading Avvo peer ratings alongside Google reviews specifically because Avvo reviews come with an attorney's stated experience and disciplinary history attached, which Google reviews do not carry. Building a presence on the niche platform, not just Google, is covered in more general terms in our local SEO work, but it matters more in regulated niches than almost anywhere else, because the niche platform often carries credibility signals Google structurally cannot.
Training the front desk, not just the software
A compliant review program is only as good as the person actually sending the ask, and in both niches that is usually front desk or intake staff, not the practitioner or attorney themselves. We write the exact script — the message wording, the timing, what never to include — and walk the team through why each piece of it exists, because staff who understand the reasoning behind "never mention the treatment" enforce it consistently, and staff who were just handed a template without context tend to drift back toward the more natural, more specific phrasing within a few months. This is a five-minute training, repeated once when a new hire joins, and it is the difference between a program that stays compliant a year later and one that quietly does not.
Responding to reviews without creating new exposure
A generic, specific reply to every review is good practice everywhere else and needs one adjustment here: never confirm, in a public reply, that the reviewer was actually a patient or client. Doing so publicly acknowledges a provider-patient or attorney-client relationship in a searchable, permanent public record, which both HIPAA-conscious practices and privilege-conscious firms should avoid regardless of what the reviewer themselves already disclosed. A safe, genuinely warm template handles this cleanly: "Thank you for the kind words — please reach out to our office directly if there's anything else we can help with," which reads as attentive without confirming a relationship the business is not supposed to acknowledge publicly.
What it looks like once it is running properly
The compounding effect is the same as any other business, just slower to build because the ask has to be more careful — a steady trickle of experience-focused, compliant reviews outperforms a burst of generic ones that get flagged or, worse, create real exposure for a client or patient. We built exactly this kind of program alongside a personal-injury firm in Newport Beach, where review growth stayed modest month to month by design and the firm's Newport Beach map pack position still improved steadily over a year, because consistent and compliant beat fast and risky every time we have tested it.
Slower and careful is not a compromise here. In these two niches specifically, it is the only version of the playbook that actually survives contact with the rules governing the business.