How to Vibe Code a Medical Spa Operations Website

Step 1: Set up Knack and structure your medspa website database

Before connecting any vibe coding tool, the database structure needs to be in place. Specifically, the MCP Server works by reading your Knack schema and exposing it to the AI builder, so the richer and more accurate your schema is before you connect, the better the generated frontend components will be.

For a medical spa operations system, start with these five core objects.

Clients. The client object is the central record. Every other object connects to it. Fields to include: full name, date of birth, contact information (phone, email, address), emergency contact, primary provider, client status (active, inactive, new), intake completion status, and any notes or tags the front desk uses for quick reference. Additionally, a unique client ID field helps with EHR matching if you have a clinical system.

Appointments. Each appointment links to a client, a provider, and a service. Fields: appointment date and time, duration, service type, assigned provider, location (for multi-location operations), appointment status (scheduled, confirmed, completed, no-show, cancelled), intake form status, deposit or payment status, and post-appointment notes. Consequently, connecting appointment status to client status enables dashboards that show outstanding follow-ups across all clients in one view.

Staff and providers. The staff object tracks everyone who delivers services or manages the business. Fields: full name, role (provider, front desk, manager, aesthetician), certifications and expiration dates, active status, and assigned locations. Notably, tracking certification expiration dates in the database lets you build automated alerts before certifications lapse, a compliance detail most med spa software misses.

Services and treatments. This object is the service menu. Fields: service name, category (injectable, laser, body, skincare), duration, base price, provider requirements (which certifications or roles can deliver it), and active status. Specifically, linking services to provider requirements makes it possible to build scheduling logic that only shows providers who are qualified for a given treatment.

Treatment records. The treatment record object stores what happened in the treatment room. Fields: date, client, provider, service delivered, products used, dosage or settings (for injectables and laser), treatment notes, before/after photo reference IDs, follow-up instructions, and consent form status. This is typically the object most generic med spa software handles poorly: treatment records need to be detailed, provider-specific, and searchable across a client’s full history.

After creating these five objects in Knack, connect the relationships: clients link to appointments, appointments link to staff and services, treatment records link to clients, providers, and services. Once these connections are in place, a single client record shows their full appointment history, all treatment records, the providers they have seen, and any outstanding intake or consent documentation.

Step 2: Connect the Knack MCP Server to your vibe coding tool

With the database structure in place, connecting the MCP Server to your medspa website is a one-step process. Knack’s MCP Server URL is https://mcp.knack.com/mcp. Add this URL to your vibe coding tool’s MCP configuration and authenticate using OAuth with your Knack builder credentials. No API keys or tokens are required.

The MCP connection works the same way across all supported tools: Lovable, Bolt, Base44, Claude Code, and ChatGPT. For tool-specific configuration steps, the Knack MCP Server setup guide covers each tool individually.

Once connected, test the connection by asking the AI to list the tables in your Knack application or describe the fields in your Clients object. If the response reflects your actual schema, the connection is working. The AI then has visibility into your exact data structure and can generate components that reference your real field names and relationships.

Important for healthcare use: the MCP connection is a build-time tool. At runtime, all data operations route through Knack’s API, not the MCP Server. PHI that enters the system after go-live flows directly to Knack’s infrastructure. Before any real patient data enters the system, confirm you are on a Knack Health HIPAA plan with a signed BAA in place. Setup and testing with placeholder data can happen on any Knack plan.

Step 3: Build your medspa website with natural language

With the MCP connection active, you can describe the medspa website in plain language and let the AI generate the interface.

Start with the core views your team needs every day. In the video walkthrough, the build covers these in sequence:

Client records view. A searchable, filterable list of all clients with quick access to each client’s full record: contact information, appointment history, treatment history, outstanding intake or consent forms, and assigned provider. The AI generates this as a connected view because it can see that your Clients object links to Appointments and Treatment Records.

Appointment calendar and scheduler. A calendar view of upcoming appointments by date, filterable by provider and location. Each appointment card shows the client name, service, and provider. Clicking through opens the full appointment record with status controls (confirm, complete, no-show) and a link to the client record. Because the AI knows your Appointments object connects to Clients, Staff, and Services, it generates these connections automatically rather than requiring you to wire them together manually.

Staff and scheduling dashboard. A view for managers showing each provider’s schedule for the day or week, open slots, and any appointments needing confirmation. Additionally, staff can see their own schedule without seeing other providers’ client details, which is where role-based access becomes important.

Service and treatment record entry. A form view for providers to log treatment details after each appointment: products used, dosage or settings, treatment notes, and follow-up instructions. It pre-populates with client and service data from the linked appointment, so the provider is not re-entering information that is already in the system.

Intake and consent tracking. A view showing which clients have outstanding intake forms or consent documentation, linked to the intake completion status field on the Client object. Front-desk staff see this as a to-do list before each appointment.

For each of these, describe what you need in plain language and let the AI build it. Because the AI has your schema via the MCP connection, it knows which fields to pull and how they connect. Consequently, refinements are fast: change the layout, add a filter, adjust the fields displayed, or swap a form field type, all through natural language.

Step 4: Add role-based access

A medical spa operations system needs at least three distinct access levels. Specifically, setting these up in Knack before going live is important, not as an afterthought once the system is in use.

Front desk. Can see and manage client records, appointment scheduling, intake status, and basic service information. Cannot see treatment notes, dosage records, or provider certifications.

Providers. Can see their own schedule and the treatment records they have created. Can create new treatment records linked to their appointments. Cannot see other providers’ treatment notes or client records outside their assigned appointments.

Managers and owners. Full access to all records, staff schedules, certification tracking, and operational reporting. Can export data, run reports across all locations, and modify service configurations.

Configure these roles in Knack’s user management settings, then tell the AI builder which views each role can access. Knack enforces these permissions at the data layer, so a front desk staff member cannot access treatment record data even if they navigate directly to a URL that would normally show it.

This is the compliance layer that most vibe-coded med spa systems skip. In short, it is not enough to hide a menu item in the UI. Permissions need to hold at the database level, not just in the interface.

The HIPAA question for medical spas

Medical spas that collect, store, or use protected health information are subject to HIPAA. Specifically, the categories that typically apply include: intake forms collecting medical history and medication lists, treatment records documenting clinical procedures by licensed providers, before-and-after photos tied to client identities, and consent documentation for medical procedures.

If your med spa employs or contracts licensed medical professionals (physicians, nurses, nurse practitioners, physician assistants) and delivers treatments that require their oversight, including injectables, IV therapy, and laser procedures at medical intensities, you are almost certainly a covered entity or operating under one. That means HIPAA compliance is not optional for the data layer of your operations system.

The practical requirement is straightforward: the platform storing patient records must sign a BAA with your organization, encrypt data at rest and in transit, support role-based access controls, and maintain record change logs on every patient record. A vibe coding tool’s default backend does not meet these requirements. Knack Health’s HIPAA plans, however, do.

Knack Health includes a signed BAA on every HIPAA plan, encryption at rest and in transit, role-based access controls at the page, record, and field level, and record change logs on every patient record. The platform is SOC 2 Type II certified. HIPAA plans start at $159/mo. For a full overview of what Knack Health provides for med spas specifically, the Knack Health med spa page covers every use case.

If your med spa is purely aesthetic with no licensed medical professionals involved, the HIPAA question may not apply. Confirm with your legal counsel based on your specific service offerings and staffing structure.

What the completed medspa website looks like

After completing the build in the video, the medspa website includes the following.

A client database with full intake status tracking, treatment history, and appointment history connected in a single record. An appointment scheduler with provider-level views and a front-desk management interface. A treatment record system that providers complete immediately after each session, building a searchable clinical history over time. A staff directory with certification tracking and expiration date alerts. A service menu connected to provider qualifications so scheduling logic only shows appropriate options.

The entire system runs on Knack’s infrastructure. The frontend, built through natural language in the vibe coding tool, reads and writes data through Knack’s runtime API. All of the data is in Knack: structured, queryable, backed up, and for healthcare use cases on a HIPAA plan, covered by a signed BAA with the appropriate technical safeguards in place.

For a solo med spa owner or a small operations team, a medspa website like this previously required a developer and weeks of build time. With the MCP connection and a structured Knack database, however, it takes a day.