Franchise compliance
you can actually prove.

At two or three locations, compliance is a culture and training problem. One person knows every operator, every permit renewal date, and every protocol that tends to get skipped on a busy Saturday. Checklists on paper and a shared drive genuinely work, because the person holding the whole picture in their head is the real system.

Somewhere around five to eight locations that stops being true. The volume of requirements exceeds what one or two corporate staff can hold. Audits slip a cycle and then another. Issues get flagged in an email thread that nobody closes. A location that is drifting does not become visible until the drift is large enough to notice from the outside, which is the worst possible moment to find out.

The specific damage is asymmetric, and this is what makes it worth engineering around. One incident at one franchised location, a sanitation failure, an expired permit, a treatment performed outside what the state allows, is reputational and legal exposure for every other location that carries the same name. The franchisor bears a risk created somewhere they were not standing.

What the compliance module does

1. Tracks the requirements

Licenses, inspections, certifications, and brand standards are tracked across locations in one place. A permit and a clinical protocol are different kinds of obligation, but they are the same kind of record: a requirement, a location, a status, and the evidence behind it.

2. Deploys audits and checklists

Build a template once, deploy it to every location or to a subset. Access is role aware, so a location manager gets their tasks, a regional manager gets their locations, and corporate gets the network view.

3. Holds the evidence

Supporting documents are stored against the requirement rather than in a general file store. This is a small structural decision with a large downstream effect: proving compliance later becomes retrieval instead of reconstruction.

4. Shows status on both sides

Compliance status is visible per location to corporate, and visible to the franchisee in their portal. The operator can see what is outstanding without asking, which is what actually changes behavior.

In a med spa, an IV therapy clinic, or a TRT practice, the compliance surface includes things that look nothing like a store checklist. Which services require physician oversight, and under what delegation. Which staff credential permits which procedure. Whether the sanitation protocol on a specific device was completed and logged, by whom, on that day. Whether the location is operating inside the scope its state actually allows, which is not the same scope the state next door allows.

That last point is the one that catches growing brands. Rules for medically adjacent wellness services vary meaningfully by state, and a model that runs cleanly in one place can require structural changes in another. The software does not resolve that for you, and any vendor claiming it interprets state law for you is overselling. What good infrastructure does is different and more useful: it lets you define your own requirement set, including the parts that differ by state, and then holds every location accountable to the set that applies to it. For the state level picture, see how med spa rules differ state by state.

The consequence of getting the category wrong in tooling is that the highest risk items are the ones that end up outside the system, tracked in somebody's spreadsheet because the platform had no shape for them.

Rollout is phased, and typically starts with a pilot region. One group of locations runs a full audit cycle in the system while the requirement set and the templates get corrected against reality, because the first draft of any requirement set is wrong in small ways that only show up in use. Then it extends. Setup is hands on rather than self serve: the work of turning your operations manual into a structured requirement set is the actual project, and it is not work to hand a franchisee.

Two constraints worth stating plainly. Data in transit is encrypted with TLS, data at rest is encrypted at the storage layer by our infrastructure providers, and each organization is isolated from every other, which matters because compliance records are among the most sensitive things a wellness network holds. And every feature is included at every plan size, with unlimited users, so a growing network is not choosing between adding location staff to the system and controlling cost.

Compliance habits get set during onboarding, not later. The standards a location learns in its first quarter are largely the standards it keeps, which is why the first 90 days of a new franchisee location deserve as much attention as the ongoing tooling.