LegitScript Certification for Telehealth Brands: Timeline, Cost & How to Pass (2026)

If you want to run paid ads for a telehealth or online pharmacy brand on Google or Meta, you need LegitScript certification first. Full stop. Google's healthcare advertising policies require telemedicine providers and online pharmacies to be certified by LegitScript before their ads will serve in the US, and Meta applies a similar requirement for prescription drug and telehealth advertisers. LegitScript is a third-party monitoring and certification company that verifies your business is properly licensed, prescribes legally, protects patient privacy, and markets its products honestly. The process is document-heavy: expect to submit corporate records, provider licensing details, prescribing policies, pharmacy relationships, and privacy documentation. Realistic timeline: several weeks to a few months, depending on how complete your application is and how fast you respond to reviewer questions. Fees are published on legitscript.com; application and annual fees generally run in the low thousands of dollars per website. This guide covers who needs certification, what reviewers actually check, why applications get rejected, and how to shorten the wait.

This is general information, not legal advice.

Key takeaways

• LegitScript certification is required before Google and Meta will approve paid ads for telehealth and online pharmacy businesses in the US.
• Telehealth brands typically apply for LegitScript healthcare merchant certification, which verifies licensing, prescribing practices, privacy compliance, and truthful marketing.
• The certification process usually takes several weeks to a few months, and incomplete applications or slow responses to reviewer questions are the main causes of delay.
• Application and annual fees run in the low thousands of dollars per website; current pricing is published at legitscript.com.
• Brands built on white-label telehealth infrastructure move through certification faster because provider licensing, prescribing policies, and compliance documentation already exist.

What is LegitScript and why do Google and Meta require it?

LegitScript is a Portland-based company that certifies and monitors businesses in high-risk, heavily regulated categories: online pharmacies, telehealth providers, addiction treatment centers, CBD sellers, and similar merchants. Ad platforms and payment companies use LegitScript as their outsourced vetting layer. Instead of Google building an internal team to verify that every telehealth advertiser holds the right licenses and prescribes drugs legally, Google requires the advertiser to hold LegitScript certification and checks for it during ad review.

The logic is simple from the platform's side. Rogue internet pharmacies and "no consult needed" prescription sites created real legal and reputational risk for ad networks. Certification is how Google and Meta separate legitimate operators from bad actors. If you're certified, you can apply for the platform's healthcare advertiser program. If you're not, ads for prescription services get disapproved, and repeated attempts to run them anyway can get your ad account suspended.

Practical consequence: you cannot advertise telehealth on Google or run ads for telehealth offers involving prescription products on Meta until certification is done. That makes LegitScript a launch-critical path item. If paid acquisition is part of your growth model, start the application while your site and clinical operations are being built, not after launch when you're burning to scale.

Who needs LegitScript certification for telehealth?

You need certification if your business advertises services that involve prescribing or dispensing prescription drugs, or if you present yourself as a telemedicine provider. That includes:

• DTC telehealth brands offering GLP-1 weight loss, TRT, sexual health, hair loss, dermatology, or similar prescription-based programs. If a customer can end up with a prescription through your funnel, you're in scope.
• Online pharmacies and dispensing partners, which apply under LegitScript's pharmacy certification rather than the healthcare merchant track.
• Brands that don't prescribe directly but market prescription outcomes. If your site advertises "get semaglutide online" and routes patients to an affiliated medical group, the platforms treat you as a telehealth advertiser. The white-label model — your brand on the front end, a licensed provider network and pharmacy behind it — still requires the brand's website to be certified.

Most white-label telehealth brands apply for healthcare merchant certification (LegitScript's telehealth/telemedicine track). Your pharmacy fulfillment partners should hold their own pharmacy certifications; you don't certify on their behalf, but reviewers will look at who you work with.

Who generally doesn't need it: pure wellness brands with no prescription pathway (supplements, coaching, non-prescription skincare). The moment a prescription product or medical consultation enters the offer, assume you're in scope.

What does LegitScript actually check during review?

Reviewers are trying to answer one question: is this a legitimate healthcare business operating legally in every jurisdiction it serves? They dig into five areas.

1. Licensing. Are the clinicians who treat your patients licensed in the states where those patients are located? Is the medical group properly registered? Are pharmacy partners licensed to dispense into the states you ship to? Expect to document the corporate structure, including the MSO and professional entity arrangement most non-clinician-owned brands use — our guide to the MSO model and telehealth compliance explains why that structure exists and how it works.

2. Prescribing policies. Reviewers check that prescriptions are only issued after a valid patient-provider relationship is established, consistent with each state's telehealth rules. Sites that promise a prescription as the guaranteed outcome of checkout, skip meaningful clinical review, or prescribe without collecting an adequate medical history will fail. Your intake flow, consult model (async or synchronous), and refusal criteria all matter.

3. Privacy and data handling. A HIPAA-appropriate privacy policy, secure handling of patient data, and clear terms of service. Boilerplate e-commerce privacy policies copied from a Shopify template are a red flag.

4. Domain and business transparency. Who owns this website? LegitScript checks domain registration, business registration, physical address, and contact information, and expects them to be consistent and verifiable. Hidden ownership, mismatched entity names, or a site that obscures who provides care invites rejection.

5. Product and marketing claims. No unapproved drug claims, no guaranteed outcomes, no marketing of products that can't legally be sold. This is where compounded medications and peptides get scrutiny — claims have to match what can lawfully be prescribed and dispensed, and categories built around research chemicals or unapproved substances won't pass.

How long does LegitScript certification take?

Plan for several weeks to a few months from application to certification. LegitScript doesn't guarantee a turnaround, and the real variable is you: complete applications with organized documentation move much faster than applications that trigger multiple rounds of reviewer questions.

The rough sequence:

1. Application and payment. You submit the application for your website with the application fee.
2. Document review. Analysts review your corporate documents, licensing, policies, and website.
3. Questions and clarifications. Almost every applicant gets follow-up questions. Each slow or incomplete response adds days or weeks.
4. Remediation. If the reviewer flags issues — a missing disclosure, a problematic product page, an inconsistent entity name — you fix them and resubmit evidence.
5. Certification and monitoring. Once approved, you're listed as certified and pay the annual fee. LegitScript monitors certified merchants on an ongoing basis, so compliance isn't a one-time event.

After LegitScript approval, budget additional time for the ad platform applications themselves (Google's healthcare advertiser application, Meta's process). Those steps are usually faster, but not instant.

Founders who get through quickest treat this like a diligence process: one internal owner, documents assembled before applying, same-week responses to every reviewer email.

How much does LegitScript certification cost?

LegitScript publishes its fee schedule on legitscript.com, and pricing varies by certification type and number of websites. As a planning number, application and annual fees run in the low thousands of dollars per site for healthcare merchant certification — confirm current pricing on legitscript.com before budgeting, because fees change and multi-site or probationary arrangements differ.

Two budgeting notes. First, the fee is per website, so each branded domain needs its own certification. Second, the fee is rarely the real cost. The real cost is revenue you don't earn while you can't run paid ads, plus legal time spent producing documents you didn't have. Certification belongs in your pre-launch budget — see our cost breakdown for starting a telehealth business for where it fits.

Why do LegitScript applications get rejected?

Common rejection and delay reasons, in roughly the order we see founders hit them:

• Licensing gaps. Advertising services in states where no affiliated provider is licensed, or a corporate structure that doesn't match state corporate-practice-of-medicine rules.
• Prescribing shortcuts. Funnels that promise medication before any clinical encounter, "questionnaire optional" flows, or marketing that implies guaranteed approval.
• Non-compliant products. Selling or implying the sale of substances that can't lawfully be prescribed — a frequent problem for peptide sites marketing research-only compounds.
• Transparency failures. Domain registration, business registration, and on-site entity disclosures that don't line up; no physical address; unclear relationship between the brand and the medical group.
• Overreaching claims. "Lose 30 lbs guaranteed," disease-treatment claims for unapproved uses, before/after content that oversells outcomes.
• Weak privacy documentation. Missing or generic privacy policies that don't reflect actual health-data handling.
• Slow responses. Not a rejection reason by itself, but stalled applications get abandoned more often than denied.

None of these are exotic. They're the same issues a competent healthcare attorney would flag, which is the point: LegitScript is checking whether you built the business correctly.

LegitScript prep checklist

Gather these before you apply. This single step compresses the timeline more than anything else.

What can you do while waiting for certification?

You don't have to sit idle for two months. Paid ads are gated; almost everything else isn't.

• Organic content and SEO. Publish condition and treatment content now — it compounds, it's not gated by LegitScript, and it feeds the AI search engines that increasingly drive telehealth discovery.
• Email and SMS. Build the list from day one. Owned audiences are the highest-margin channel in telehealth and independent of ad platform policy.
• Creator and influencer distribution. If your brand is creator-led, organic social is often the primary launch channel anyway, with paid layered on after certification.
• Affiliate and partnership traffic. Referral arrangements need their own compliance review (anti-kickback rules apply in healthcare), but properly structured partnerships can drive traffic pre-certification.
• Build the machine. Tighten your funnel, intake conversion, and retention flows so certified traffic doesn't land on an unoptimized site later.

If you're still deciding how to structure the business itself, start with our pillar guide to white-label telehealth platforms and the walkthrough of how to start a telehealth business without a medical license.

How does a white-label infrastructure partner speed up certification?

Look back at the checklist table. Most of the rows aren't marketing artifacts. They're clinical and corporate infrastructure: licensed providers in every state, a compliant prescribing policy, pharmacy relationships, MSO documentation, HIPAA-grade privacy practices. Building from scratch, you create all of that before you can even apply credibly.

If you launch on white-label telehealth infrastructure, most of it already exists. A platform like MyOrbitHealth operates a 50-state licensed provider network, established prescribing and consult protocols, certified pharmacy fulfillment partners, HIPAA-compliant intake and EMR systems, and the MSO/friendly-PC legal structure — which means the documents LegitScript asks for are the documents the platform already maintains for every brand it powers. Your application becomes an exercise in assembling existing paperwork and making sure your website matches it, not a six-month project to stand up clinical operations.

It also helps on the marketing-claims front. Infrastructure partners that have been through certification with prior brands know which claims survive review and which trigger remediation letters, so your site copy gets built compliant instead of rewritten after a rejection. Several established players in this space, Beluga Health among them, are themselves LegitScript certified — a reasonable signal to look for when comparing white-label telehealth platforms.

Certification is still your application for your domain, and no partner can promise an approval or a date. But the difference between "gathering documents that exist" and "creating documents from nothing" is usually measured in months.

Frequently asked questions

Do I need LegitScript certification to advertise telehealth on Google?

Yes, for prescription-based telehealth in the US. Google's healthcare policies require telemedicine providers to be certified by LegitScript and then approved through Google's own healthcare advertiser application before ads will serve. Without it, telehealth ads are disapproved.

How long does LegitScript certification take for a telehealth company?

Typically several weeks to a few months. The biggest variables are the completeness of your initial application and how quickly you respond to reviewer questions. Well-prepared applicants with organized documentation land at the faster end of the range.

How much does LegitScript certification cost?

LegitScript publishes current pricing on legitscript.com. As a planning figure, application and annual fees run in the low thousands of dollars per website, and each separate domain requires its own certification. Confirm the current fee schedule before budgeting.

Can I run ads for telehealth on Meta without LegitScript?

Not for prescription drug or telehealth offers. Meta requires certification (via LegitScript) for advertisers promoting prescription drugs and telehealth services, and applies additional restrictions to categories like weight loss. Non-prescription wellness offers may be able to run under standard policies.

What gets telehealth companies rejected by LegitScript?

The most common causes are licensing gaps in states they advertise to, prescribing flows that promise medication without a real clinical encounter, non-compliant product claims, inconsistent or hidden business ownership details, and weak privacy documentation. Most rejections are fixable, but each remediation round adds weeks.

Does using a white-label telehealth platform mean I skip LegitScript?

No — your brand's website still needs its own certification. But an infrastructure partner shortens the process substantially because the provider licensing, prescribing policies, pharmacy relationships, and compliance documents LegitScript reviews already exist and have been through review before.

Get certified faster with infrastructure that's already compliant

LegitScript certification is a documentation test, and you pass it by having real clinical infrastructure behind your brand. MyOrbitHealth provides that infrastructure out of the box: a 50-state provider network, compliant prescribing workflows, pharmacy fulfillment, HIPAA-grade systems, and the MSO structure — so your certification application starts from a complete file instead of a blank page. Book a demo with MyOrbitHealth to see how brands launch on compliant rails from day one.