How a Sacramento salon or med spa can answer booking questions with AI without breaking privacy rules

It is a weekday afternoon at a salon in Sacramento. The front desk person is typing the same reply to the same question about Saturday availability while a second call rings through and a client waits at the counter. AI can draft and send those routine booking answers automatically, which frees the person at the desk for the calls that actually need a human.

This works only if the line between safe and unsafe questions is drawn deliberately. Sacramento is a city of roughly 536,000 residents according to the U.S. Census Bureau's July 2025 estimate, and the wellness practices serving them collect names, phone numbers, birthdates, and sometimes health details in the course of ordinary booking. Those details sit inside the reach of the California Consumer Privacy Act.

What the California Consumer Privacy Act asks of a small practice

The California Consumer Privacy Act, or CCPA, is the state law that gives consumers control over the personal information businesses collect about them. For a salon or med spa, three duties matter most. Under Civil Code section 1798.100, a business must, at or before the point of collection, tell consumers the categories of personal information being collected, the purposes for collecting it, and whether that information is sold or shared. It also bars collecting additional categories or using collected information for incompatible new purposes without fresh notice.

Clients also have a right to request deletion of their personal information under section 1798.105, and a right to request correction of inaccurate personal information under section 1798.106. A practice that takes bookings and intake forms through any tool, AI-assisted or not, needs a way to honor those requests.

A separate state law, the Artificial Intelligence Training Data Transparency title in the Civil Code, requires developers of generative AI systems to post documentation about the data used to train systems made available to Californians. That duty sits with the developer, not the salon, but it is one reason to know which tool you are using and what it says about its own data.

Which booking questions are safe to automate

The safe set is anything that would be answered identically for a stranger walking in off the street. Hours and days of operation, parking, the cancellation policy, which services take how long, pricing tiers for standard services, and the general process for booking are all fair game. A good test: if the answer would be printed on a public menu or the front window, an AI reply is fine.

These replies work best when they are written once and approved by the owner, then sent as-is. The AI answers from a small approved list rather than improvising, which keeps the answer accurate and keeps client data out of the prompt.

What must stay human

Anything tied to a specific person's body, history, or dispute stays with a person. That includes questions about whether a treatment is right for a client's skin condition or medical situation, anything involving a complaint or refund, records requests, and any conversation where the client sounds upset. It also includes anything a client asks to have deleted or corrected under the CCPA, because those are legal requests with legal deadlines, not customer service questions.

The practical rule for the front desk: AI handles questions about the business. People handle questions about the client.

Setting up safe FAQ replies and intake forms

A practice does not need a consultant to write the FAQ list or the intake notice. Any owner can do it in an afternoon with a text document and the booking form they already use. The mistake to avoid is skipping the notice at collection, because the CCPA duty applies at the intake form itself, not later.

Practices that want help scoping the work can bring in Cali AI Lab. Its AI Concierge service pairs a practice with one person from the team who learns the business, holds two 1-hour working calls a month, and helps with small setups like this one. Everything starts with a free 25-minute fit call on Zoom that looks at two repeating tasks and picks a first result worth having.

Questions before you try it