Commissioning digital support for an aesthetics business

Start with the business decision, not a channel label

SEO, AI search optimisation, local search, web design and website maintenance are service labels, not a complete brief. Before commissioning any of them, define the decision the work must support. That may mean making a treatment menu understandable, protecting enquiry handling during a redesign, correcting incomplete location information, or ensuring an established site remains accurate after staff and service changes. It is not enough to state that the business wants more traffic or wants to appear in AI-generated answers. Those outcomes do not identify the operational constraint, the material to be produced, or the person authorised to approve it.

Write a commissioning statement naming the services in scope, the geographical footprint actually served, the treatment categories involved, the intended audience, the pages or records affected, and the internal owner of the decision. Separate salon services, cosmetic retail and regulated medical activity where they appear under one trading name. Their evidence requirements, claims risk and customer journeys can differ substantially.

State what the provider is not authorised to do. In an aesthetics business, this commonly includes approving efficacy wording, changing medical or cosmetic claims, publishing patient material, responding to clinical enquiries, or creating offers without sign-off. A provider can structure, draft and maintain information, but the operator remains responsible for the service presented and the claims made in its name.

Decision rule: if a proposed task cannot be tied to a page, record, customer action, evidence source and accountable owner, do not commission it yet.

Define the information a supplier may use

Many avoidable failures begin with vague or unverified source material. Give a supplier an approved information pack rather than asking them to infer services from social posts, old pages or competitor language. The pack should distinguish facts that can be published now from claims that need evidence, review or removal.

At minimum, define the legal business identity, trading names, service locations, opening arrangements, contact and booking routes, treatment names, practitioner roles where relevant, qualifications the business has chosen to publish, aftercare process, cancellation terms and current product or service availability. A treatment name used internally may not be sufficiently clear for a customer-facing page. Record the plain-language description approved by the business and the limits of what it says.

For aesthetic services, build a separate claims register. List each outcome statement, who supplied it, the supporting material held, any required wording, its last review date and the person allowed to approve it. The Advertising Standards Authority administers the UK advertising codes. Its practical relevance here is that advertising claims need a defensible basis. No provider should turn a loosely expressed commercial ambition into a public result claim without an agreed evidence and approval route.

Photos, testimonials, before-and-after material and practitioner biographies need their own permissions and checks. A usable image file is not automatically permission to publish it in every context, edit it, retain it indefinitely or use it in paid promotion. Capture the permitted use, expiry or review date, source and restrictions. Keep consent and publication approval as separate records where both are relevant.

• Give the supplier approved facts rather than informal message threads.
• Mark content as approved, draft, expired or awaiting evidence.
• Do not use a competitor page as the source of a treatment claim.
• Require proposed wording to identify its source record before publication.

Verify claims, local facts and customer evidence

Verification is different from writing. A well-written page can still contain an outdated practitioner role, an unavailable treatment, an unsupported outcome claim or a location detail that sends a customer to the wrong place. Commission a verification pass before a new site goes live and whenever a significant service, location or team change occurs.

For every public service page, check what the customer can book, who delivers it, whether the description matches the actual consultation and treatment process, what is included, and which words might imply a clinical outcome or certainty of result. Where a treatment has medical, prescription, device or injectable implications, route the wording to the appropriate person inside the business and obtain specialist advice where needed. A marketing supplier should not be made the final authority on a clinical or legal conclusion.

Local search work should begin with a single approved location record for each customer-facing venue. Verify name, address, telephone contact, opening times, access information, booking route, services offered there and temporary closures. Maintain a list of every third-party listing or directory the business has actively claimed or supplied. The aim is operational consistency, not an inflated footprint. Do not create pages for areas where the business has no meaningful basis to serve customers, and do not present virtual coverage as a physical venue.

Reviews and testimonials require a controlled workflow. Keep the original source, date received, publication permission where needed, edits made for length or clarity, and the page or campaign where it appeared. Do not add treatment outcomes the reviewer did not state. Do not treat a customer review as substitute evidence for a performance claim. The business should retain its own substantiation rather than relying on a supplier's assurance.

Verification rule: publish a treatment, location or testimonial statement only when its source, current status, permitted use and approver can be identified from the business record.

Set ownership and access before work starts

Digital work can become costly in time and risk when the business does not control its own essential accounts, files and records. Commissioning should therefore specify ownership, administrator access, recovery contact details and handover duties from the first day. This is governance, not merely a technical preference.

The business should retain access to its domain registration, website hosting, content management system, analytics records, booking integration, business email, local listings, image library and any paid accounts it funds. A supplier may need delegated access to perform work, but delegated access is not the same as ownership. Keep an access register showing the account purpose, account owner, administrator, recovery contact, supplier access level, last access review and removal date.

Ask in writing where site files, copy, photographs, design assets and records of changes will sit. Define what happens to drafts and administrator accounts when the arrangement ends. Require a usable handover: credentials or transfer process, current asset inventory, maintenance history, known defects, list of integrations and a record of outstanding work. Avoid arrangements that make a business dependent on a supplier simply to edit opening hours or remove an expired claim.

The Information Commissioner's Office explains the UK data protection framework and provides guidance for organisations. If a provider can access enquiry forms, booking data, customer communications, photographs, treatment information or email lists, identify what data is involved, why access is needed, how long it lasts, who gives instructions and how access is removed. Do not give broad account access merely because it is convenient.

idigitgroup.com sells retained SEO, AEO and AI search optimisation, local search, web design and website maintenance to UK businesses. That stated service scope still requires written ownership, approval and data-access boundaries.

Commission design and AI-facing content with controls

Web design is not only a visual decision when a site represents aesthetic services. Design affects whether a visitor can identify the provider, understand a treatment, find practical information, recognise a commercial message and make contact without being led by ambiguity. Write the required content components before approving layouts: a clear service description, who the service is for where appropriate, consultation information, limitations, relevant aftercare, a contact route and the business identity behind the page.

AI search optimisation should be commissioned with the same restraint. Define the approved source material from which summaries, question-and-answer content and structured service descriptions may be derived. Require the supplier to flag uncertainty rather than filling gaps with generic assertions. An answer that sounds polished but overstates suitability, safety, permanence or likely outcome can create a claims problem even where it was generated from fragments of previous copy.

Set a content governance route for new pages and amendments. Identify who drafts, who checks factual accuracy, who checks claims and permissions, who gives final approval, and who publishes. The route should cover urgent changes too, such as a practitioner leaving, a treatment being paused or a booking route failing. Keep version history for clinically sensitive or heavily promoted pages so the business can see when wording changed and why.

Do not commission a redesign solely against mock-ups. Test the live customer path. A mobile visitor should be able to understand the service, find location information, identify how to enquire, read important conditions and reach a human contact route. Record issues raised by reception and practitioners after launch because they see where wording and page structure fail in real enquiries.

• Approve copy separately from visual design.
• Keep generated drafts labelled until reviewed.
• Use a named sign-off owner for claims-bearing pages.
• Test customer journeys after changes, not only before launch.

Maintain the site as an operating record

Maintenance is the continuing work of keeping a public business record usable, secure and current. It should be commissioned as a schedule of duties, escalation routes and evidence of completion, rather than as a vague promise to keep a website looked after. The schedule will vary with the systems in use, but it should name the assets covered and the person who checks supplier reports.

Maintain a change log with the date, requestor, pages or systems affected, reason for the change, approver, publisher and outcome. This makes it easier to reverse an error, retire a claim, answer an internal question and identify recurring operational problems. Maintain a separate issue log for broken contact routes, inaccessible pages, expired certificates, form failures, booking problems, lost access and content that no longer reflects practice.

A practical maintenance review should include current business facts, service availability, practitioner information, location data, reviews used on-site, consented image use, terms, privacy material, enquiry and booking paths, form recipients, software updates, backups and access permissions. The frequency should reflect the rate of change and risk, but changes to services, staffing, clinical information or locations should not wait for a routine cycle.

Require the provider to report what changed, what was checked, what failed, what requires business input and what remains unverified. A report that only lists activity does not allow an operator to decide whether public information remains reliable. The business should retain the authority to pause publication when evidence is missing or a claim needs review.

Maintenance also requires a route for staff who spot errors. Reception staff may identify a broken booking path, a practitioner may see an outdated qualification, and an operations lead may know that a service has been withdrawn. Give each of these people a clear method for logging an issue, identifying urgency and confirming that the correction has appeared publicly.

Use reporting to support decisions, not visibility promises

Reporting should show whether commissioned work has been completed, whether public records remain accurate and what decisions need business input. It should not be limited to a list of technical actions or broad claims about online visibility. Decide in advance which records the supplier will provide and which member of the business will review them.

Useful operational reporting can include pages created or amended, source records used, approvals obtained, publication dates, unresolved evidence questions, account-access changes, defects found and maintenance work completed. Where customer journeys have been tested, record the route tested, the issue identified, the person responsible and the current status. This creates a usable trail when staff change or a disputed statement has to be reviewed.

Keep performance interpretation proportionate. Changes in enquiries can reflect seasonality, service availability, staffing, booking capacity, promotions, local conditions and changes to the business itself. A supplier should be able to describe work undertaken and the information available, but a business should avoid treating a short-term movement in a metric as proof that a claim, page or channel decision was correct.

Reporting rule: every report should identify completed work, unresolved risks, decisions required from the business and the next review point. If it cannot do this, it is an activity summary rather than a management record.

Limits of this commissioning framework

This framework covers the business controls around commissioning digital support for a UK aesthetics operator. It does not provide instructions for ranking in search results, manipulating answer engines, writing code, measuring supplier performance against a scoring model, or selecting between providers. Those are separate disciplines and should not be confused with the operator's responsibility for its public information.

It is not legal, medical, clinical, tax or data-protection advice. It does not determine whether a specific treatment, device, medicine, procedure, image or claim is lawful. Where a service involves regulated activity, medical treatment, prescription-only medicines, invasive procedures, patient information or a disputed advertising claim, the business should obtain advice suited to its circumstances and ensure the appropriate internal decision-maker is involved.

It also does not apply unchanged to a product-only cosmetics business, a multi-site group with central compliance functions, or an independent practitioner with no staff. The controls still matter, but the records, access model and approval steps should be proportionate. A small operator may combine roles, while a larger group may need formal delegation and audit trails.

The key boundary is that a digital supplier can support publication and maintenance, but cannot assume responsibility for the truth, evidence, permissions or commercial appropriateness of material that the business has not defined and approved.