LegitScript Certification for Med Spas: The Checklist, Annotated

Why med spas need certification at all

The pressure arrives through payments and advertising, the same as for telehealth. A med spa selling prescription services online (GLP-1 programs, TRT, prescription skincare) is a high-integrity-risk merchant to the card networks and a restricted advertiser to Google and Meta, and certification is the standard verification both sides accept. The moment a med spa adds an online store or a telehealth arm to its physical practice, it inherits the whole framework.

The med-spa category also carries its own review emphasis. Because the industry sits at the junction of medicine and wellness retail, LegitScript's checklist concentrates on the two junction failures: menu items that aren't lawful products at all, and medical claims made in wellness language without substantiation.

The menu items that block certification

LegitScript's med-spa guidance names a barrier tier: offerings that block certification while they're on the menu. Steroids marketed for bodybuilding or performance. hCG marketed for weight loss (the FDA has been explicit that hCG isn't approved for weight loss, and compounded hCG weight-loss products sit on the wrong side of that). Stem-cell and exosome therapy marketed for unapproved indications. And ozone therapy. If any of these are on your menu, or on a co-owned brand's menu, expect them to dominate the review.

The same logic extends to the experimental-peptide list (BPC-157, CJC-1295, and their relatives) that we cover in the problem-products guide: a med spa retailing 'recovery peptides' alongside its aesthetic services has a catalog problem no disclosure can fix.

The honest move is triage before application: barrier-tier items come off the menu, not into smaller print. A certification reviewer can work with a claim that needs rewording; they can't waive a product that can't lawfully be sold.

Sort your menu into three buckets before you spend the application fee: lawful and defensible, lawful but claim-sensitive, and barrier tier. The third bucket doesn't get better copy; it gets removed.

The scrutiny tier: legal menu, dangerous claims

A second tier of med-spa offerings survives certification but draws concentrated claims review: NAD+ programs, hyperbaric oxygen therapy, and hormone-replacement marketing. The offerings are workable; the marketing usually isn't, because it was written to sell ('reverses aging', 'cures brain fog', 'builds muscle mass') rather than to survive FDA and FTC substantiation rules.

The pattern that passes review is wellness framing without disease-treatment or performance promises: what the protocol is, who administers it, and what patients can expect operationally, with outcome language held to what evidence actually supports. Hormone marketing that promises increased muscle mass is specifically named in LegitScript's guidance as a flag, which tells you reviewers are reading for exactly that sentence.

Before/after imagery deserves its own audit line: it's endemic in aesthetics marketing, restricted on the ad platforms, and reviewed skeptically everywhere. Where you keep it, keep it typical, consented, and un-retouched.

The operational questions the checklist asks

Beyond the menu, LegitScript's med-spa checklist recurs on a handful of operational items that applicants should have answers for before the analyst asks:

• Standing orders: if nurses or aestheticians operate under standing orders or protocols, be ready to show they're lawful in each state where you use them, including who signed them and what they cover.
• IV and vitamin-therapy programs: name every pharmacy that compounds or supplies them, with credentials. 'Our supplier' is not an answer; a licensed, named pharmacy is.
• Supervision and delegation: who performs each service, under whose license, and whether that delegation is permitted in your state's scope-of-practice rules (these vary widely; verify per state rather than assuming).
• Licensure inventory: the medical director's license, every injector's credentials, and facility registrations where your state requires them, current and documented.
• Ownership structure: many states restrict who may own a medical practice (corporate-practice-of-medicine rules), and reviewers understand MSO arrangements; undocumented ones read as evasion.

The website layer

Everything the general certification standards require of a telehealth site applies to a med spa's site too: the legal business name and physical address visible, licensure disclosed, a working phone and support path, privacy policy and terms that match reality, compounded-medication disclosures wherever compounded products are sold, and no equivalence claims pinning your compounded GLP-1 to a brand name.

Med-spa sites accumulate a specific kind of debt here: service pages written years apart, by different marketers, with different levels of care. The fastest way to find the outliers is to read every service page in one sitting the way a reviewer will, or to let a scanner do the first pass: our free Preflight tool crawls the site, flags barrier-tier and scrutiny-tier offerings by name, and checks the disclosure and claims layer alongside.

Where Embed Care fits

For med spas adding an online prescription arm (GLP-1 programs, hormones, longevity protocols), Embed Care operates the whole telehealth layer under your brand: licensed clinicians, compounding pharmacy supply, payments built for healthcare, and storefronts that ship certification-ready because the catalog and copy discipline described above is built in. Your physical practice keeps its identity; the online program arrives with the compliance already done. The med-spa weight-loss guide covers the business model side of that same move.