Kintsu Medspa

TL;DR

Running a Simple Cortex engagement, I built a physician-led medical aesthetics brand from a blank slate and turned it into an operating system for voice, imagery, marketing, SEO/AEO, and AI-assisted contribution. I held the pen alone: I wrote the six-document brand system and authored 209 of the 214 commits in the site repo. Live at kintsuaesthetics.com since January 2026. The proof so far is internal but real: the brand compressed into a 71-line contract AI contributors read every session, and the site shipped with an honest 79/153 (52%) SEO/AEO baseline and a plan to reach 85%+ by Q1 2027, not a vanity number.

Polish is cheap. Trust is the hard part.

A new medical aesthetics brand can look polished and still say nothing.

The harder job was building trust before the first appointment. The category is full of soft-focus luxury language, generic transformation promises, and sites that treat skin of color as an afterthought. This practice was physician-led, clinically careful, and built for patients who have often been underserved by aesthetic medicine.

I treated the brand as infrastructure, not a moodboard. Clinical without cold, warm without vague, premium without sounding like every other medspa. And the system had to hold once AI-assisted contributors joined the production workflow, not just while I held the pen.

What I did

• Built the brand from a blank slate: voice, imagery direction, marketing architecture, AI design guidelines, SEO/AEO audit, and site plan, delivered as six long-form documents in the repo.
• Set five voice pillars with the client face to face before the site system hardened. The tagline "Repair. Restore. Radiate." only works if the voice earns it.
• Designed for skin of color as the default patient, not an addendum. Positioning, treatment education, and page hierarchy make Fitzpatrick III through VI care visible before the first scroll.
• Encoded the bar where the work happens: brand guidelines, voice rules, prohibited words, and AEO guidance written as living artifacts the build could use, not PDFs outside the product.
• Ran a 153-item SEO/AEO audit and set the baseline honestly at 79/153 (52%), then wrote a maintenance plan targeting 85%+ by Q1 2027 instead of shipping a vanity number.

The voice came down to one line I killed. The category defaults to soft-focus luxury copy, and the first draft of the treatment language reached straight for it: "Radiance, reimagined for you." It scans as premium and says nothing a patient can trust. So I cut it and wrote what should replace it: "Evidence-based care for skin that has been overlooked." One is aspirational and generic. The other is specific, clinical, and names the patient the category ignores.

I could have kept the pretty sentence and moved on. Instead I turned the choice into a rule, a SAY THIS / NOT THIS pair in the Voice and Imagery Guidelines, because a physician-led practice earns trust by being concrete, and because a rule survives handoff where a single good sentence does not. Then I mirrored the same pairs into the AI contributor contract, so the next time an AI drafts a page it inherits the judgment instead of reaching for the luxury cliché again. The line I killed is the reason the ones that follow it hold.

Brand Identity page · kintsuaesthetics.com

3 points

123

1Kintsugi, encoded2Holds on light3Holds on dark

01 · Kintsugi, encoded

The name and mark borrow kintsugi, the art of repair. The philosophy is written down, not implied, so every contributor builds from the same metaphor.

The practice launched with skin-of-color positioning leading the story instead of sitting in a footnote, and the voice rules did not stay on paper. They run in the build, where any reviewer, human or AI, can cite a prohibited word at pull-request time. The point was never the document count. It was that a new contributor can execute the brand without re-litigating taste every time. That is design leadership applied to brand: make judgment portable.

The booking portal

The brand system was always meant to close the loop at the booking step. The second phase shipped a live /book funnel backed by a production API at api.kintsuaesthetics.com.

• Built real treatment category tabs by mapping Zenoti's services API server-side (parallel fetches, 1-hour cache). Added provider-scoped deep links so a staff member can share /book?p=pooja-shah and the funnel locks to that provider's eligible services and live slots. Added a session-scoped client cache so returning to the time-selection step is instant instead of re-fetching availability.
• Hardened the backend for production: retry with Retry-After honor, TTL caches at two tiers, body-key idempotency, per-IP rate limiting, strict CORS allowlist, and PHI-scrubbed logs. Deployed as a Docker container behind Coolify's Traefik reverse proxy, TLS-terminated at api.kintsuaesthetics.com.
• Chose VPS over AWS after re-assessing the practice's HIPAA status: Kintsu does not bill insurance, so it is likely not a covered entity and a BAA is not legally required. That finding eliminated the operational overhead of AWS KMS, CloudTrail, and formal BAA paperwork while retaining the technical privacy controls already built. The decision and revert triggers are documented in ADR-0010; the AWS plan is preserved as a fallback.
• Corrected pricing transparency on every surface: "$13/unit" is the dose price for Botox, not a treatment entry point. Built isPerUnitPrice() so per-dose prices are excluded from all minimum/"from $X" computations, JSON-LD price ranges, and the llms.txt feed. The framing shifted from a price that misleads to one that informs: "$13 per unit" with package context instead of an anchor a patient cannot act on.
• Hardened the funnel for touch: useHasHover() gates hover interactions behind a pointer-capable device, so touch taps do not trigger or stick desktop hover states. Summary remove targets are always visible on touch (36px) and reveal-on-hover only on a pointer device. Measured tap targets in the browser before changing them; two speculative fixes were dropped because the defaults were already correct.

Measuring it, and letting it run

A brand system and a booking funnel are inputs. Neither tells you whether the money going out the door is working. Paid ads were running with no automated read on them at all, and the weekly digest designed to fix that had been written months earlier, never committed, and never once run. The third phase closed that gap: an experimentation program on the site, a monitor on the spend, and a deliberate answer to how much either is allowed to do on its own.

• Shipped the A/B program in three phases (2026-07-25). Assignment goes through a permanent getVariant() facade backed by the GrowthBook SDK in local-payload mode, so call sites never change if the payload source does. Standing rule for the program is small maintained OSS over hand-rolled bucketing or statistical numerics.
• Made the power discipline mechanical. Every experiment declares minimum sessions per variant (typically 1,500) and minimum duration (typically 28 days) at creation, and both must be met independently before anything can read as a decidable win or loss. The gate is a script with exit codes, not a judgment call, because "does this look significant yet" is exactly the question people answer wrong when they want a result.
• Baked control into the prerendered HTML and made assignment return control whenever the browser reports itself as automated. One rule covers the Puppeteer prerender, the Playwright suite, and most crawlers, which means variants can never become accidental SEO cloaking.
• Amended the concurrency rule in writing rather than silently. The program launched at one running experiment site-wide because the site runs around 38 sessions a day. ADR 0011 raised that to three, but only on distinct routes with independent traffic, specifically so a paid-campaign landing page would not wait behind an unrelated hypothesis. The per-experiment floors did not move, and the original decision text was preserved and annotated instead of rewritten.
• Built the daily ads monitor with a deliberately asymmetric autonomy envelope (ADR 0012). The autopilot may pause an ad, pause an ad set, or decrease a budget. That is the whole allowlist. It can only spend less money and show fewer ads, every action is reversible in one click, and copy, creative, targeting, budget increases, and anything price-bearing stay permanently human.
• Enforced least privilege in-process because the vendor offers no key scoping. Two independent conditions must both hold for any write, blocked writes throw before any network request, and every write emits an audit line into the immutable Actions log on both the success and failure paths. All scheduled work runs on an always-on Linux VPS runner, so nothing depends on a laptop being open.

The decision I care most about here is what I kept out. No LLM sits in the decision path or the write path. The account produces roughly seven conversions a week with a one to three day lag, which is about one data point per day, and a loop that is always thinking against that stream is a loop reacting to noise it cannot distinguish from signal. The shape is three batch tiers instead: a daily deterministic sweep, a weekly digest, a monthly human review. Language models synthesize the narrative and generate hypotheses for a human. They never execute. I had a fresh-context architecture review run against the frozen design looking for the case that I was being too conservative, and it argued independently against an always-on agent.

Stress-testing before enabling any of it surfaced four defects that all reported healthy. The guardrail protecting running experiments matched experiment ids against campaign names and scored zero matches across eight campaigns, so it was decorative; it now joins on the ad's destination URL. The zero-conversion alert used a share-of-spend rule that sat where the probability of a legitimate zero was 37 percent, which would have trained me to ignore it inside a week; it is now derived from the account's own CPA. One live campaign pointed at a hash-fragment booking URL that the pathname-routed site resolved to the home page. And two different budget situations, a capped winner and an efficient campaign that never reaches its cap, were being treated as the same finding.

The honest outcome so far is that the first two hero experiments were stopped as unconcludable rather than called. At this traffic level the floors bite, which is what they are for. The system's value right now is that waste gets caught daily instead of whenever someone remembers to look, and that a winner cannot be declared early by anyone, including me.

Reflection

1. The brand foundation is internal proof. The booking portal is now live and taking appointments. The next metric that matters is market behavior: search visibility climbing, consultation starts, booking conversion. The system is built to measure those. Until the numbers land, I should say so plainly rather than dress a baseline up as an outcome.

2. Voice drift is the predictable cost of putting AI in the production model. If I ran this engagement again I would pair the SEO/AEO audit with a quarterly voice review from the start. The answer is not less AI. It is a tighter review rhythm so the 71-line contract stays honest as the site grows.

3. I would bring a design systems engineer in earlier. I authored 209 of 214 commits, which made me the single point of failure on the build. That was fine for a launch and would not scale past one.