The market puts Podium at roughly $400 to $600 a month, standalone. That's a real number, and it's worth sitting with — but the more useful fact isn't the price, it's the word "standalone." Podium is an add-on. It sits on top of whatever already runs your calendar, your chart, your consent forms. It doesn't replace that system; it sits next to it.
For context, the broader medspa CRM market runs from about $100 a month for a single-location starter tier up to $600 or more for multi-location plans that bundle AI and marketing in. Podium's price sits inside that range. It just doesn't buy you the system underneath it.
Total Cost, Not the Sticker
Compare it straight: Lumè's AI SMS agent is $249 a month, included in the Pro tier, alongside the full medspa CRM — scheduling, charting, consent, payments, memberships, marketing. Podium's $400 to $600 a month is a separate purchase, on top of whatever you're already paying for the system that actually runs your calendar.
We say this a lot because it's the mistake we watch owners make most: compare total cost, not the sticker. The cheapest headline plan is often not the cheapest system, once you've layered on the texting tool, the review tool, the payment processor, and the marketing platform that don't talk to each other. Four logins. Four support lines. Four places PHI might end up living. A client record that's really four half-records, stitched together by whoever remembers to check all four inboxes.
The other expensive mistake is buying up or down a size. A solo injector doesn't need a multi-location enterprise platform, and a five-location group can't run on a single-provider scheduling tool with a texting add-on stapled to the side. Size the system to the practice you run now, not the one you might run in three years.
What the Agent Actually Does
A text comes in at 8:40pm asking about a filler touch-up next week. The agent reads live availability, not a static list someone updated Monday morning. It checks which providers are eligible for that specific service, checks the client's account or package balance if one exists, and books the appointment or offers real times back.
It does this through structured, audited tool calls: check availability, check provider eligibility, check balance, write the booking. Each step is a discrete, logged call — not a model guessing at what your calendar looks like and generating something plausible. A tool that isn't reading the same record your front desk runs on can't tell a no-show risk from a client with a package already paid down, and it can't tell you which provider is even eligible for the treatment being asked about.
The Safety Rails
The system prompt is PHI-free. The agent isn't handed a client's treatment history to reason over when it drafts a reply — it works off scheduling logic, not a medical chart.
Every outbound message passes a pre-send pattern scan for sequences that match a Social Security number, a date of birth, or a payment card number. A match blocks the send before it goes out and escalates the conversation to a human immediately. That's a second layer behind the first: the agent is instructed not to produce that content, and the scanner catches the rare case where the instruction doesn't hold.
Staff can pause the agent per conversation, right from the inbox — one thread, not the whole system. Handling something delicate for one client doesn't require shutting off booking for everyone else. There's a daily send cap, so the agent can't run unsupervised at volume. And there's a clear escalation path for anything clinical or payment-related — the agent hands off to a person rather than guessing.
Booking Logistics Only
SMS isn't encrypted end-to-end. A text sitting on a carrier network doesn't carry the same security posture as a message inside a portal behind a login. So AI-generated SMS is kept to booking logistics — time, date, provider, confirmation — and nothing else. Anything clinical, anything about a specific treatment, anything about a balance or a charge escalates to a human who can move the conversation somewhere more appropriate.
An agent that will happily text "your neurotoxin touch-up is due" is announcing a specific injectable, on a specific date, onto a network with no end-to-end encryption. We'd rather the agent stay inside a boundary we can defend than sound clever and leak clinical detail onto a channel we don't control.
BAA-Eligible Infrastructure, Not a Compliance Guarantee
The AI SMS agent runs on a BAA-eligible LLM path — infrastructure on OpenAI, Anthropic, or Google's BAA-eligible offerings, not a consumer API with no contractual privacy backing. The model provider is itself a business associate the moment PHI touches its systems, and it needs to be bound the same way any other vendor touching a client record does.
That sits inside the rest of the architecture: a Business Associate Agreement included in the standard contract at every tier, tenant data isolated at the database level, an append-only audit log on every PHI read, encryption in transit and at rest. We don't sell that as an add-on, because we don't think it should be one. If compliance is a paid tier, the base product doesn't have it — HIPAA and a BAA should be the floor at every tier, not an enterprise upgrade you chase down after you've already signed.
None of this guarantees your practice is compliant end to end — that depends on how you use the system and what your state adds on top of federal HIPAA. What we can build is defensible architecture underneath your own workflow.
The Stitching Is the Real Cost
Scheduling, client charts, e-signed consent, and integrated payments all live on the same client record inside Lumè — so the agent booking a Tuesday appointment is reading the same chart, the same consent status, the same package balance your front desk sees when the client walks in. A texting add-on priced at $400 to $600 a month, sitting next to a separate scheduler, is answering messages against a separate system, with a separate record, and no guarantee of a matching audit trail.
That gap doesn't show up on either price page. It shows up months in, when someone's trying to reconcile a client's package balance against a text thread that lives somewhere else entirely.
This is built for solo nurse injectors, single-location spas, and small multi-location groups adding providers and rooms. Lumè is not the right call for a large enterprise chain — that's Zenoti's lane, not ours. If you're running one or two locations and outgrowing a salon tool, the question isn't which texting add-on is cheaper. It's whether you want two records or one.