Digital brand assets in a med spa sale: inventory rights, access, and the handover

Inventory each digital asset by legal rights, platform account, owner, administrator, recovery method, vendor, and required transfer step. Include domains, websites, business profiles, social accounts, phone numbers, creative files, analytics, and booking integrations. Verify the buyer can control and use the agreed assets through a secure handover; possession of a password does not establish ownership or transferability.

What belongs in the digital asset inventory?

Start with every public path a patient uses to recognize, find, contact, or book with the practice. Include domains, websites, landing pages, business profiles, social accounts, phone and text numbers, email domains, appointment links, advertising accounts, analytics, creative libraries, and relevant integrations.

A digital asset handover inventory records the asset, associated rights, account identity, controlling parties, dependencies, transfer steps, and acceptance evidence. It is broader than a password list. Its purpose is to establish what the buyer may use and whether practical control has actually changed.

Mark assets included, excluded, licensed, shared, or unresolved. A founder’s personal social account can be different from a practice account, and an agency may control an account used for the practice. Ask counsel to establish the rights before assuming every item bearing the clinic’s name transfers.

How do ownership and administrator access differ?

An administrator may be able to publish or manage an account without owning the underlying content, contract, domain registration, or brand rights. Billing authority and recovery access can sit with another person. Identify each layer and the evidence supporting it.

Collect relevant agreements, invoices, registration records, licenses, permissions, and account-role information. Determine whether an agency, former employee, contractor, franchisor, or founder has retained rights or control. Resolve gaps while the necessary people are available rather than discovering them at closing.

Do not put secrets in a broadly accessible data room. A preliminary inventory can identify platforms, ownership, and dependencies without exposing credentials. Use a secure, appropriately authorized handover process when the transaction reaches the agreed stage.

What should be checked for domains and websites?

ICANN’s domain-transfer FAQ explains registrar-transfer processes and circumstances that can prevent or delay a transfer, including certain locks. Review the actual registrar, registration status, registrant changes, timing, and current policy. A domain transfer and a hosting migration are different tasks.

Identify registration, DNS, hosting, website code or content system, certificates, email services, renewal dates, and payment methods. A change made in one place can affect several services. The handover plan should identify the person qualified to preserve continuity during the change.

Confirm the scope of website and creative rights. Templates, stock images, fonts, software, and contractor work may have license or assignment questions. Have counsel review the actual terms. Technical access to a file does not establish that the buyer may publish or reuse it without restriction.

How should business profiles and social accounts be handled?

Google’s Business Profile ownership-transfer guidance describes the primary-owner process and limitations for newly added owners or managers. Verify the current procedure and the actual account’s status. Do not assume that changing a password is the appropriate way to transfer every platform relationship.

Review each social and review platform’s current rules and available account roles. Separate personal profiles, business pages, advertising accounts, catalogs, payment settings, and connected apps. A single login may control several assets, some of which are outside the sale.

Record whether the account’s public name, location, category, or ownership change requires additional review. Avoid promising that every rating, follower, verification status, or historical feature will remain unchanged. Platform outcomes can depend on the actual change and applicable rules.

What does a complete inventory entry look like?

Keep the account identifier precise enough to avoid transferring the wrong page or number. Distinguish similarly named assets and duplicate profiles. A brand can have several abandoned pages, old domains, or agency accounts, and the agreement should not leave their treatment implicit.

Which phone, email, and messaging dependencies are easy to miss?

Map the public numbers, carrier or provider accounts, routing, voicemail, text services, booking notifications, and recovery uses. A number used for patient calls may also be a multifactor-authentication destination. Porting or cancelling it without planning can lock the team out of unrelated systems.

For email, identify domains, mailboxes, aliases, forwarding, shared inboxes, retention, and access permissions. Have counsel and privacy reviewers determine what records and communications may transfer or remain accessible. Personal correspondence and patient information require appropriate treatment rather than a blanket mailbox handover.

Test published contact paths from an outside device at the appropriate stage. Confirm calls reach the intended team, replies arrive, and booking messages do not send patients to an old account. Assign responsibility for correcting directory listings and automated messages that still display obsolete details.

How can the handover preserve security?

The FTC’s Start with Security guide describes practical principles for limiting access and protecting data. Apply a reviewed process for authorized roles, recovery methods, vendors, credentials, and retention. The transaction should not expand access indiscriminately simply to make the checklist look complete.

Use platform role transfers where appropriate, establish the buyer’s recovery control, and remove obsolete access through an agreed sequence. Preserve required seller access only under defined authority, duration, and safeguards. Avoid shared personal accounts that make later access and accountability unclear.

Document an emergency contact and rollback or recovery process for critical services. Do not make a high-impact DNS, phone, or booking change without the responsible technical and operating people available. A secure transition should also keep patients able to reach the practice.

What acceptance tests should be run before the item is marked complete?

Verify the buyer’s authorized owner or administrator can perform the agreed actions, manage recovery, and access required records. Test billing and renewals, vendor support, and the critical patient-facing paths. Record the date and evidence without saving sensitive authentication values in the inventory.

An illustrative acceptance test for a domain could confirm the agreed registrant or account control, DNS access, renewal payment method, and functioning website and email. A business-profile test could confirm the appropriate ownership role and the ability to manage the listing under current platform rules.

The tests depend on the asset and agreement. A successful login is only one observation. The buyer also needs lawful rights, reliable recovery, and continuity, while the seller needs confidence that excluded personal or unrelated assets have not been transferred inadvertently.

How do you resolve an asset that cannot transfer on closing day?

Identify the reason, impact, responsible person, evidence needed, and expected resolution. Counsel should determine whether a consent, temporary arrangement, price treatment, holdback, or other provision is appropriate. Do not silently describe the asset as transferred when control or rights remain unresolved.

1. Inventory public paths and backend dependencies.
2. Verify rights and current control.
3. Review platform and vendor requirements.
4. Plan secure role and recovery changes.
5. Test patient-facing continuity.
6. Record acceptance and unresolved items.

Use the seller hub, reputation guide, sale-documents guide, and Transferability Stack. Digital goodwill becomes usable when rights and practical control arrive together, with the dependencies needed to keep the practice reachable.

What should happen after the first week?

Recheck renewal notices, recovery contacts, automated messages, vendor access, and unresolved transfers. Some problems appear only when a bill arrives, a campaign runs, or a password reset is requested. Assign an operating owner for the remaining inventory rather than treating the closing checklist as finished forever.

Preserve agreed evidence and retain access logs where appropriate. Update the inventory as systems change. This creates a useful operational asset for the buyer and reduces avoidable requests to the former owner for account information months after closing.

Educational analysis prepared with AI-assisted research for The Med Spa Broker. “Last reviewed” records the source and editorial check date; it does not imply review by an attorney, clinician, or independent appraiser. Read our editorial standards.