LegitScript Certification: The 2026 Guide for Clinics

On a single day in February 2026, the FDA sent warning letters to 30 telehealth companies over how they marketed compounded GLP-1 medications. In June, 25 more letters went out. Google rewrote parts of its prescription drug advertising policy in August 2025 and has been enforcing it against med spas, IV clinics, and hormone providers ever since. State attorneys general spent 2025 publicly pressuring Meta over misleading weight loss ads, and in December the FTC finalized an order against a telehealth GLP-1 seller over deceptive pricing and unsubstantiated claims.

At the same time, the demand side has never looked better. J.P. Morgan Research projects roughly 25 million Americans will be taking a GLP-1 medication by 2030, and the clinics built around weight loss, hormone optimization, longevity, and precision medicine are among the fastest growing practices in healthcare.

That is the paradox every provider entering this space has to resolve. The categories with the most patient demand are also the most restricted to advertise. The gate between the two is a certification most new clinic owners have never heard of until their first ad gets disapproved: LegitScript.

This guide covers what LegitScript certification actually is, who needs it and who does not, what it costs, how Google and Meta each treat it, why peptides and testosterone and GLP-1s each play by different rules, and how to build a clinic that can advertise for the next decade instead of the next quarter.

A note before we start: this is an educational guide, not legal advice. Patientfy is not affiliated with LegitScript and does not issue or sell certifications. Decisions about your clinical model, licensure, and compliance obligations belong with a qualified healthcare attorney.

What LegitScript certification actually is

LegitScript is a third party certification and monitoring company. Its healthcare certifications are recognized by Google, Meta, Microsoft, TikTok, and major payment processors as evidence that a healthcare merchant operates legally and transparently. When an ad platform says a telehealth provider must be "certified," LegitScript is, in most cases, the organization doing the certifying.

The Healthcare Merchant Certification, the one most relevant to clinics in weight loss, hormone therapy, and telehealth, applies to businesses involved in the online sale, prescribing, or facilitation of prescription medications. The review verifies the things a regulator would ask about: that your providers are licensed in every state you serve, that prescriptions come from a legitimate clinical encounter rather than a checkout flow, that your pharmacy partners are legitimate, that your ownership is transparent, and that the claims on your website match your actual credentials.

Certification is the entry ticket, not the ad approval. LegitScript itself is explicit that certification may be required to advertise but does not guarantee your ads will be approved.

That distinction is the single most misunderstood thing about this entire topic, so it is worth stating plainly. There are two separate layers. The first is eligibility: certification plus platform authorization, which determines whether you are allowed to promote prescription services at all. The second is creative compliance: what your ads actually say and show, which is governed by each platform's claims and imagery rules. Clinics clear the first layer and then get suspended on the second one all the time. A durable ad presence requires both.

Who needs it, specialty by specialty

The dividing line is not your specialty. It is whether your business prescribes, sells, or facilitates prescription medications online. Here is how that plays out across the specialties in this space.

Two nuances in that grid deserve emphasis, because they are where practices most often get the answer wrong.

The first is the med spa flip. Thousands of aesthetic practices added weight loss programs between 2024 and 2026, and many kept advertising the way they always had. The moment the GLP-1 offering went online, their ad accounts crossed into telemedicine territory without anyone in the building realizing the category had changed. If you offer aesthetics plus an online prescribing program, the stricter rulebook governs the account.

The second cuts the other way: you may need less than you think. Meta's policy explicitly allows general telehealth promotion without any authorization, as long as the ads do not promote specific prescription drugs. Educational content about a condition is treated the same way. A clinic can build brand, audience, and demand around its service and its providers while certification is in progress. What it cannot do is name the medication.

What it costs and how long it takes

For the Healthcare Merchant Certification, LegitScript charges a $975 nonrefundable application fee per website and, on approval, a $2,150 annual certification fee per website. An expedited review that begins within two business days costs an additional $2,500. Applicants with prior compliance issues may be offered a probationary tier at $3,995 per year with closer monitoring. Addiction treatment certification is a separate program with per facility pricing.

Against what a clinic in this space typically spends on advertising, that is a small line item. The real cost is time. LegitScript does not publish a guaranteed timeline; clean applications commonly clear in four to eight weeks, and complicated ones take months. The applications that stall or fail tend to share the same defects: providers not licensed in every state the website serves, prescribing flows that promise medication before any clinical encounter, outcome claims the clinic cannot substantiate, opaque ownership structures, and privacy documentation that does not hold up.

Notice what that list actually is. It is not marketing paperwork. It is the checklist of whether the clinic is built correctly as a healthcare business. That is the most useful way to think about the entire process: the certification review is a dress rehearsal for the scrutiny that regulators, boards, and platforms will apply to your business for as long as it exists. A clinic that cannot pass it has a business model problem, not an advertising problem.

Google and Meta: same certifier, different rulebooks

Both platforms lean on LegitScript, but the requirements around it differ in ways that matter for planning.

Beyond eligibility, each platform enforces its own creative layer, and this is where certified clinics still get hurt. Meta's health and wellness standard requires weight loss and cosmetic procedure ads to target adults only, requires results imagery to indicate the time it took to achieve the result, and prohibits ads built on negative self perception. The FTC requires health claims to be backed by competent and reliable scientific evidence, and its December 2025 order against NextMed shows what happens when typical results claims, hidden costs, and manufactured reviews meet that standard. And the FDA's warning letter waves in 2025 and 2026 focused heavily on one specific claim pattern: marketing that implies a compounded medication is equivalent to, or interchangeable with, the FDA approved drug.

Peptides, testosterone, and GLP-1s each play by different rules

Clinics in this space tend to treat "prescription marketing" as one category. The platforms and regulators do not, and the differences are where the traps live.

GLP-1 medications are FDA approved drugs, which makes them advertisable by certified and authorized providers. The complexity is on the compounded side. After the FDA declared the tirzepatide and semaglutide shortages resolved in December 2024 and February 2025, the enforcement discretion that allowed mass compounding ended, and in April 2026 the FDA proposed permanently excluding semaglutide, tirzepatide, and liraglutide from the list that permits outsourcing facilities to compound them. A clinic whose model or marketing depends on cheap compounded GLP-1s is building on ground that has been shrinking for over a year.

Testosterone adds a third rulebook on top of LegitScript and platform policy: the DEA. Testosterone is a Schedule III controlled substance, and prescribing it via telehealth without a prior in person exam currently rests on temporary flexibilities that have been extended through December 31, 2026, with a special registration framework for telemedicine prescribers expected from the DEA. A hormone clinic's marketing plan sits on top of a prescribing framework that is actively changing, and the clinics that will sail through that change are the ones whose clinical encounters were already robust.

Peptides are the trap. In 2026 the FDA moved several popular peptides, including BPC-157 and ipamorelin, back toward pharmacy compounding eligibility, and much of the industry read that as legalization. It is not. Compounding eligibility means a pharmacy may prepare the compound under certain conditions. It is not FDA approval, and none of these peptides has an FDA approved indication. Under Google's prohibitions on unapproved pharmaceuticals and speculative or experimental treatments, that keeps them out of ads entirely, certification or not.

The most expensive misunderstanding in this industry right now: "the FDA allows it to be compounded" does not mean "Google and Meta allow it to be advertised."

What peptide and longevity clinics can market is the layer above the compound: the clinical service, the diagnostic workup, the provider expertise, and the specialty itself. That is not a consolation prize. It is where the durable brand gets built, and it is content the platforms actually want.

The shortcut graveyard

Every clinic that gets banned follows roughly the same road, and it starts with treating a policy problem as a technical one.

Google gives seven days of warning before suspending an account for most healthcare violations. Egregious violations skip the warning. And the workarounds that get passed around in industry groups, such as opening a fresh account, running a clean "compliant" page that redirects to the real offer, or borrowing an agency's account, all fall under the circumventing systems policy, which Google treats as egregious by default. Suspensions under that policy propagate: to linked accounts, payment profiles, and related business identities, and they block new accounts. The ban follows the business, not the login.

That is the honest math of shortcuts. Certification costs about $3,000 in year one and some weeks of patience. The workaround risks the permanent loss of the two largest patient acquisition channels that exist, at the exact moment your category is booming. Nobody selling a "we can get you live without certification" service is pricing that risk in, because they will not be the ones holding it.

Building the clinic that can advertise forever

Everything above compresses into a sequence. The clinics that dominate this category for the next decade will be the ones that did it in this order.

The through line is that certification rewards clinics for being what they claim to be. Every requirement on that list, real encounters, real licensure, substantiated claims, transparent ownership, is also what state boards, the FTC, and the FDA are checking. Do it once, properly, and you have not just unlocked advertising. You have built the operating foundation that survives the next warning letter wave, the next platform policy update, and the next DEA rule, while competitors who took shortcuts rebuild from zero.

Where Patientfy fits

Patientfy is not a law firm, not a certifier, and not affiliated with LegitScript. What we are is the marketing platform for practices in exactly these specialties, and our agents are built to operate inside these rules rather than around them.

The Google Ads and Meta Ads agents build campaign structures that respect certification boundaries, from the drug term rules to geographic and age targeting, so a certified clinic's spend goes into growth instead of appeals. Campaign Strategy plans the phased path: what a clinic can run before certification clears, and what unlocks after. And Search & Authority builds the organic and AI search presence that paid ads cannot gate, which matters in a category where patients research for months and increasingly ask AI assistants which clinic to trust.

The practices winning in weight loss, hormone optimization, and longevity are not the ones that found a way around the rules. They are the ones that got certified early, marketed inside the lines, and compounded while everyone else was appealing suspensions. If that is the kind of practice you are building, we would like to be the marketing partner behind it.