Kandji or Rippling IT for a Multi-Location MedSpa Group

Not quite, and treating them identically usually backfires. A treatment-room tablet that only displays consent forms and intake questions can run in a single locked-down app with no browser, no email, and no way for a patient to wander into settings. A front-desk laptop needs a real operating system with the practice management software, a browser for insurance portals, and enough flexibility for a receptionist to actually do the job.

Both Kandji and Rippling IT can enforce a locked single-app mode on iPads, so the treatment-room fleet isn't really the deciding factor. The front-desk and back-office machines are.

Sort each device into a policy tier along these lines:

• Treatment-room tablets that show consent forms and intake questions run in a single locked-down app, with no browser, email or access to settings.
• Front-desk laptops running practice management software need a full operating system, with encryption and access control protecting patient records.
• Marketing laptops that never touch patient records get lighter restrictions, so the policy does not slow the team down or get worked around.
• Equipment control computers from aesthetic device vendors usually stay out of management, since installing software on them can conflict with the vendor's warranty.

If every device in the group, front desk through back office, is a Mac or an iPad, Kandji's depth on those platforms is hard to beat. Zero-touch enrollment means a new front-desk hire's Mac shows up configured before they open the box, and the treatment-room iPads can be locked into single-app kiosk mode from the same console that manages the office laptops.

The catch is the same one that applies everywhere: the moment a Windows machine enters the picture, whether it's a piece of aesthetic equipment's control PC or an accountant's laptop, Kandji has nothing to say about it.

A MedSpa group that grew by acquiring existing practices often inherits a mixed fleet: whatever the previous owner happened to buy. Rippling IT covers Mac and Windows from one console, which matters more here than in a shop that standardized on Apple from day one.

Rippling IT's other advantage is specific to healthcare staffing: aesthetic practices hire and lose front-desk and treatment staff often, and tying device provisioning to the same HR record used for payroll means a new hire's laptop is ready on day one instead of two weeks later.

Plenty of MedSpa booking platforms, membership billing systems, and point-of-sale software were built for Windows first, and some never shipped a Mac version at all. If that's the software running your front desk, it settles the platform question regardless of what the treatment rooms use, since Kandji simply can't manage the machine running it. A group in that position is better off standardizing on Rippling IT across the whole fleet, including any Mac or iPad devices, rather than splitting management across two tools for the sake of the treatment-room iPads alone.

Before-and-after photography is routine at a MedSpa, and it's often shot on a staff member's personal phone because nobody issued a dedicated camera. Neither Kandji nor Rippling IT manages a personal phone unless the owner enrolls it, and most staff won't want to. The fix isn't a device policy at all: issue a dedicated camera or tablet for clinical photography, enroll that one device, and keep personal phones out of the workflow entirely. A device platform can enforce a rule; it can't create one where none exists.

This is worth fixing early rather than after an incident, since a personal phone with client photos on it is exactly the kind of gap a patient complaint or a state board inquiry tends to surface. A single enrolled iPad per location, locked to the photo and charting apps and nothing else, closes it for the cost of one device instead of trying to police everyone's personal phone.

A single MedSpa can get by with the owner or an office manager handling device setup by hand. Add a second and third location and that stops working: nobody's checking whether the new location's front-desk machine has the same restrictions as the first one, and inconsistency is exactly what an insurer or a state board notices during an incident review.

National wage data puts the median salary for a general operations manager, a role commonly asked to cover this kind of cross-location oversight at a growing MedSpa group, at $105,770 a year¹. Weigh that against a device platform's subscription cost before deciding a manual process still works at three locations.

Say your group opens a fourth location this year and the office manager who's been handling device setup by hand is already stretched thin running the original three. That's usually the point where a platform pays for itself, not because the manual process was ever wrong, but because it stops being anyone's actual job to keep doing it consistently.