As demand for GLP-1 and longevity care surges, LegitScript certification has become the gate to the two things every telehealth clinic depends on: advertising and payments. Having guided 250+ clinics through the process, White Label MD’s compliance team answers the questions founders actually need answered.
A conversation with
Justin Champion, CEO,
White Label MD.
Licensure is one of the first things LegitScript reviews. For weight loss and longevity clinics, that means being licensed in every state where a patient is located, not just where the clinic operates. Where do clinics most often discover a gap, and how costly is it to close?
The most common gap is geographic, and it comes from a wrong assumption. Founders think they need to be licensed where their clinic or their provider sits. But in telehealth, the law that governs care is the law of the state where the patient is located at the time of the visit. So a clinic running national ads with providers licensed in three states is, in practice, accepting patients it can’t legally treat in the other 47.
Closing it isn’t quick or cheap. Credentialing a provider in a new state takes time and money for each state, and licensing boards move at their own pace. The clinics that avoid the scramble decide their service-state map before they spend a dollar on ads, and build provider coverage to match.
GLP-1 demand brought a surge of clinics prescribing through both asynchronous and questionnaire-only models. LegitScript Certification requires licensed providers to deliver care before any prescription is issued. How does that play out for telehealth-first clinics, and what does a compliant care model actually look like?
The standard is easy to state and easy to get wrong: A licensed provider has to actually evaluate the patient and make the prescribing decision before any prescription is issued.
Asynchronous care can absolutely meet that bar. A provider reviewing a detailed intake, labs, and history and then making a real clinical judgment is legitimate telemedicine in most states. What doesn’t pass is the questionnaire-only model where a patient fills out a form and a prescription is generated with no genuine provider review, or where the “review” is a rubber stamp. Some states also require a synchronous video or phone component for certain prescriptions.
A compliant model has a real provider in the loop, documented clinical decision-making, and state-by-state logic for when a live visit is required. If your model only works because no one is actually practicing medicine, it won’t survive certification or an audit.
LegitScript’s affiliate and partner standards require pharmacy partners to be certified or accredited, and that flows upstream to the clinic. How often does a partner pharmacy become the obstacle that stalls an application?
More often than founders expect. LegitScript’s standards extend to your affiliates, and your pharmacy is the biggest one. If your fulfillment pharmacy isn’t appropriately licensed and accredited, or carries its own compliance baggage, that becomes your problem, and it can stall or sink an otherwise clean application.
We see founders choose a pharmacy on price, turnaround, or willingness to work with compounded GLP-1, without vetting the compliance side at all. By the time it surfaces in review, they’re weeks in and have to re-paper a core part of their supply chain. Vetting the pharmacy partner before you build around them is one of the highest-leverage moves a founder can make.
In the competitive weight loss and longevity markets, advertisers often use aggressive techniques. What are the most common transparency pitfalls clinics walk in with, and how do you clean them up?
This category attracts aggressive marketing, and that’s exactly where applications get flagged. The usual culprits: outcome claims that imply guaranteed or typical results, efficacy claims about the medication that go beyond what’s substantiated, before-and-after imagery without context, and pricing that hides the real subscription terms.
LegitScript wants advertising that’s truthful, substantiated, non-deceptive, and from a website that actually matches the ads. Cleaning it up means walking outcome promises back to what’s defensible, adding the right disclaimers, making pricing and cancellation terms unmissable, and aligning landing pages with ad copy. It’s less about neutering the marketing and more about making every claim one you can stand behind.
As part of the LegitScript Certification application process, applicants must provide full disclosure of disciplinary history for the business, its principals, and affiliated practitioners going back 10 years. For a white-label model with multiple providers, does that make the process more complex? What happens when something surfaces mid-application?
This is where the white-label model adds real complexity. The disclosure isn’t just about the business. It covers principals and affiliated practitioners, going back a decade. When care is delivered by a network of providers, that’s a lot of histories to surface and stand behind.
The work is front-loaded due diligence: know your providers’ and partners’ records before you submit, rather than discovering them in review. When something does surface mid-application — a past board action, a lapsed license, a prior business issue — it’s not automatically disqualifying, but it has to be disclosed and contextualized honestly. What sinks applications usually isn’t the issue itself; it’s the appearance of hiding it.
One of the main reasons clinics pursue LegitScript Certification is access to advertising on Google, Meta, and other platforms. What does responsible advertising look like post-certification?
The most important thing to note is that certification isn’t a license to say anything. It’s the start of an ongoing, monitored relationship. Responsible advertising post-certification means claims stay substantiated, pricing stays transparent, and your ads, landing pages, and actual service stay aligned.
It also means living inside the platforms’ own healthcare advertising policies, which are stricter than the law in places, and not drifting back into the aggressive claims that got the category scrutinized to begin with. The clinics that keep both their certification and their ad accounts treat compliance as a standing discipline, not a one-time gate they cleared.
For a founder just deciding whether to pursue LegitScript Certification, what’s the single biggest misconception they’re carrying and what do you wish they knew before starting?
It’s that certification is NOT a paperwork exercise — something you apply for, pay for, and receive. It isn’t. LegitScript verifies that your operation is genuinely compliant: your licensure, your clinical model, your pharmacy, your marketing, your data practices. You can’t paper over a model that doesn’t hold up.
The founders who struggled with the process built the business first and treated compliance as a final step to bolt on. The ones who breeze through prioritize compliance from day one. What I wish more founders knew: The application doesn’t make you compliant, it checks whether you already are.
Weight loss clinics collect sensitive patient data, including weight history, lab results, and medication records. How prepared are most applicants on privacy and data security, and where do the gaps appear?
This is consistently the most underprepared area. Founders focus on providers and pharmacy and treat data as an afterthought, despite handling incredibly sensitive PHI and PII.
The gaps we see most: missing business associate agreements with vendors who touch patient data, privacy policies that don’t reflect what the clinic actually does, no documented security safeguards, and no real breach-response plan. HIPAA isn’t a checkbox; it’s an operating posture. The clinics that are ready for certification treat data protection as infrastructure, not legalese, and it shows in how smoothly that part of the review goes.
LegitScript requires clinics to clearly disclose which states and territories they serve. For a clinic that wants to grow quickly, how does that shape launch strategy and what’s the risk of moving faster than licensure allows?
You have to disclose exactly which states you serve, and that disclosure has to match reality. The risk for a growth-minded founder is serious: It’s tempting to flip on national advertising and sort out licensure later, but accepting or prescribing for a patient in a state where you’re not licensed is a real violation, not a technicality.
So licensure has to lead expansion, not trail it. Practically, that means launching in the states you’re covered in, expanding licensure deliberately, and gating your marketing to your actual footprint. Growing faster than your licensure is one of the fastest ways to turn a promising clinic into an enforcement problem.
Compounded semaglutide became a flashpoint in 2024 and 2025, with the FDA’s position shifting and many clinics caught in a gray area. How do you advise clinics navigating drugs in regulatory uncertainty?
This is the hardest terrain in the category right now. Compounded semaglutide and tirzepatide expanded largely because the brand drugs were on the FDA shortage list, and as those shortages resolved, the legal footing for routine compounding narrowed and the FDA’s posture shifted.
The honest advice: Don’t build a business whose survival depends on a regulatory gray area. We tell founders to operate within current FDA guidance, work with qualified regulatory counsel, document the clinical basis for any compounded prescribing, and have a plan for branded medications so a single rule change doesn’t end the business overnight. The clinics that get hurt are the ones who bet everything on the gap staying open.
White Label MD promises a 30-day launch. Where does certification fit, parallel or first? And realistically, how long does it take for a well-prepared applicant?
It runs in parallel, but it has to start early. Review takes weeks, so we kick it off near the front of the launch, not the end to ensure that the platform, the clinical model, the pharmacy, and the marketing are all built to be certification-ready as we go, rather than retrofitted afterward.
For a well-prepared applicant, which includes complete documentation, licensure that matches the service map, a vetted pharmacy, a compliant site, review typically runs about two weeks. The reason most clinics take three or four months isn’t the review itself; it’s the back-and-forth of deficiency notices when they applied before they were ready. Doing it in parallel, and prepared, is the whole reason a 30-day launch is realistic.
LegitScript Certification unlocks both advertising and payment processing permissions, but is also the single most common place telehealth founders stall. White Label MD has guided 250+ clinics through it, and manages the entire process as part of a 60-day launch.
