The Telehealth Website Compliance Checklist: 40 Things Reviewers Look For

Read the four authority levels before the forty checks

L1 means the requirement appears in LegitScript's own published standards or terms. L2 means it is law or regulation, enforced by the FDA, the FTC, HHS, or a state, and it binds you whether or not you ever apply for certification. L3 means a platform or payment-network rule, which can cost you an ad account or a merchant account without any regulator being involved. L4 means a best practice or a reviewer signal: nothing compels it, and its absence still makes a reviewer look harder at everything else.

One note on what is missing. None of the forty below is L3, and that is not an oversight: the platform and payment-network rules that decide whether you can advertise at all are not things a reviewer reads off your website, they gate your ad account and your merchant account from the outside. Our advertising guides cover that layer, and it is worth reading alongside this one, because a site can pass every check here and still be unable to buy traffic.

The practical consequence is priority. An L2 failure is a legal exposure that survives every certification outcome, so it goes first. An L1 failure blocks the application you are about to pay for. An L3 failure quietly kills your distribution. An L4 gap is worth closing before you apply because reviewers are people, and a site that answers the easy questions cleanly gets less scrutiny on the hard ones. None of the forty below is an automatic disqualification, and treat any tool or consultant that says otherwise with suspicion: controlled substances, compounded products, and brand-name mentions are all context questions, not instant failures.

The ordering rule that saves the most time: fix L2 first because it is legal exposure, L1 second because it blocks the application you are paying for, L3 third because it decides whether you can advertise at all, and L4 last because it only makes the review easier.

Who is behind the site (6 checks)

Reviewers start with identity, because everything else is downstream of knowing who they are looking at. This is also the cheapest section to pass and the one most often left half-done by brands that launched from a template.

• L4 · The legal entity operating the site is identifiable somewhere on it, not just the consumer brand name.
• L4 · A physical business address is available. A mailbox service grades softer than nothing at all, and nothing at all is the common failure.
• L4 · A patient-support phone number is published, not just a form.
• L4 · The medical group or clinical entity is named on the site, distinct from the brand.
• L1 · The relationship between the platform, the medical group, and the pharmacy is explained accurately, so a reader can tell who prescribes, who dispenses, and who is charging the card.
• L1 · Patients can reach the dispensing pharmacy's contact information, including a physical address and phone number. Note precisely what this is and is not: it is an access requirement, not a requirement to name your pharmacy partners in your marketing.

What you actually sell, described honestly (5 checks)

This section is where compounded programs live or die, and it is almost entirely L2: these are FDA and FTC questions that would exist with no certifier in the picture. A compounded medication is not a generic, it is not FDA-approved, and describing it as either is the single most expensive sentence a GLP-1 brand can write.

• L1 · Each product's regulatory status is represented accurately on the pages that sell it.
• L2 · No investigational product, and nothing without a lawful human-drug pathway, is promoted for treatment. Read the scope precisely: a compounded medication is by definition not FDA-approved, and a product that meets the 503A or 503B conditions can lawfully be dispensed without that approval, so this check is not an instruction to remove your compounded program. It targets research-use and investigational products marketed as treatments, and the research-use framing has to be carried consistently through the ad, the landing page, and the checkout, or it is not framing at all.
• L2 · Compounded status is disclosed on every surface that sells the product, not once in a footer.
• L2 · Nothing implies FDA approval for a compounded or otherwise unapproved product, including approval-adjacent design cues like agency seals or approval language near a price.
• L2 · No generic-equivalence claim for a compounded product. Phrasing that gets close to equivalence without saying it belongs in review rather than in a rulebook, because intent and context decide it.

The claims layer, which is mostly FTC (8 checks)

Marketing copy is where the most findings cluster, and almost none of it is certification-specific: this is advertising law, and it applies to your ads, your landing pages, your email, and your creators' posts equally. The FTC's endorsement guides are the reference, and the standard they set is substantiation before publication, not after a complaint.

Two traps worth naming, and the first is usually stated too bluntly. Testimonials do not have to depict typical results: the FTC's endorsement guides leave two routes open, either the testimonial reflects what a typical patient experiences, or the advertiser clearly discloses the generally expected performance and can substantiate that disclosure. What does not work is the middle path most sites take, a wall of exceptional outcomes with a generic results-not-typical line underneath, which discloses nothing about what to expect. And before-and-after imagery is not prohibited, but it carries a substantiation burden most programs cannot meet for the product they are actually selling.

• L2 · No guaranteed-outcome claims anywhere, including in the headline and in ad creative.
• L2 · Quantified outcome claims are substantiated for the product you actually sell, not for a different molecule studied in a trial you did not run.
• L2 · Superlatives and superiority claims are substantiated, or removed.
• L2 · No absolute-safety claims.
• L2 · Testimonials either reflect what a typical patient experiences, or clearly disclose the generally expected performance, with that disclosure itself substantiated. Both routes are open under the FTC's endorsement guides; a bare results-not-typical line next to an exceptional claim is neither.
• L4 · Before-and-after imagery is absent, or tightly disclosed and substantiated.
• L2 · No FDA logo or government seal, anywhere, in any form.
• L4 · No branded injection pens or manufacturer packaging illustrating a compounded formulation. This is the visual version of the equivalence claim, and it reads the same way to a reviewer.

The prescribing journey, as it actually runs (6 checks)

The distinguishing feature of this section is that most of it cannot be audited from the page source. A reviewer, or anyone with a browser, can walk your funnel and compare what happens to what you said would happen. That gap is the finding.

• L1 · No guaranteed-prescription or guaranteed-approval language, and the site says plainly that not every visit results in a prescription.
• L1 · A provider evaluation genuinely precedes prescribing, in the real click-path and not just in the description of it.
• L4 · Prescription-required language sits near every medication mention and every price, not only on the product page.
• L2 · Intake screens for contraindications, in a way a clinician would recognize as screening.
• L4 · The journey you describe matches the journey a patient walks. This is the most common quiet failure: the copy describes a consultation the funnel does not contain.
• L1 · The jurisdictions you serve are disclosed, and the intake or checkout actually enforces them rather than taking an address and moving on.

Walk your own funnel as a patient, on a phone, paying real money, before anyone else does. Most findings in this section are not writing problems; they are the difference between the site's story and the site's behavior.

Money, and who is charging it (6 checks)

Billing disclosures are simultaneously a certification item, a consumer-protection question, and the thing most likely to generate chargebacks, which is its own separate path to losing a merchant account. Recurring prescription programs get scrutinized harder here than any other model.

• L1 · Prices are consistent across every surface: ad, landing page, product page, checkout.
• L2 · Renewal and recurring-billing terms are disclosed at the point of sale, not only in the terms of service.
• L1 · Consultation, membership, and other fees are disclosed alongside the medication price rather than appearing at checkout.
• L2 · The cancellation mechanism works the way the site says it works. Test it on a real account.
• L1 · Payment timing is described accurately, particularly the difference between authorizing a card and capturing a charge before a prescription decision exists.
• L4 · The merchant of record on the statement matches the entity the site says is charging the card. A mismatch here reads as a red flag to reviewers and to banks, for the same reason.

Privacy and tracking, where the tools are the problem (6 checks)

This is the section where a growth team's ordinary work creates the exposure, and it is almost entirely L2. A pixel installed sitewide for conversion tracking becomes a privacy problem the moment identity and health-condition interest combine in a transmission to a company that has no duty to protect either. Our tracking-pixel guide covers the architecture; these are the checks a scan can see.

• L1 · Valid TLS sitewide, and especially on any form that collects health information.
• L1 · The privacy policy matches the actual business model rather than being a template for a different kind of company.
• L2 · Health-information handling is addressed specifically, not folded into generic personal-data language.
• L2 · Marketing consent is a genuine opt-in, not a pre-ticked box or an inferred consent from a purchase.
• L2 · No advertising pixel transmits condition or treatment-selection data, which is the specific pattern that produced the enforcement record in this category.
• L2 · No session-replay or heatmap tooling on surfaces that collect health information, and no health information in URLs or query strings where it lands in analytics and referrer headers by default.

The legal pages, read rather than counted (3 checks)

The last three checks are about whether the documents describe your business or someone else's. A reviewer who opens a terms page and finds an e-commerce template with no mention of a provider relationship has learned something about the whole operation, and the finding is rarely limited to the page.

• L4 · Terms of service exist and define the platform, provider, and pharmacy roles as they actually work.
• L2 · Telehealth informed consent is present and adequate for the care you deliver.
• L4 · The legal pages' contents correspond to the business model. Copied text is easy to spot and hard to explain.

What to do with the list

Run it in the priority order from the top of this page: every L2 item first, because those are legal exposures that outlive any certification outcome; then L1, because those block the application whose fee you are about to spend; then L3 and L4. Fix the copy problems in an afternoon, because most of them are copy problems. Then walk the funnel as a patient, which is the only way to catch the journey findings, and have someone who did not build the site read the legal pages.

Our free readiness scanner runs the machine-checkable subset of this list against your live site and returns the findings with these same authority levels attached, which is the fastest way to see where you stand before the application fee is committed. The pre-application checklist covers what the scanner cannot see, and the certification cost calculator prices the rest of the path.