LegitScript certification for a telehealth brand: cost, timeline, and what reviewers check

The LegitScript certification cost is the number most operators look up first, and it is the least important part of the process. LegitScript's own healthcare certification page lists a $975 nonrefundable application fee per website, a $2,150 annual fee per website once approved, and an optional $2,500 expedited fee that gets the review started within two business days. Against the cost of standing up a clinic, that is small. What the fee buys is a structural audit of the business: who owns it, who prescribes, where the medication comes from, and what the website claims. A brand whose MSO and professional corporation are drafted correctly, whose pharmacy relationships are licensed, and whose marketing copy has been scrubbed will find certification is mostly paperwork. A brand with a shortcut in any of those places will find out during the review.

What the certification covers

LegitScript certifies healthcare merchants, and the eligible categories on its page include online and physical pharmacies, telemedicine providers offering remote clinical services, medical spas with licensed professionals, and digital health platforms that facilitate the sale of prescription medicine. A white-label telehealth brand is usually certified as a telemedicine provider, and if it operates its own dispensing it may also need the pharmacy standards to apply. The certification attaches to a website, which is why the fees are per website: a brand running two domains for two verticals is two applications.

The review applies a set of nine standards that LegitScript publishes in summary. In plain terms, the merchant must hold the licenses appropriate to the services and the jurisdictions it serves; comply with prescription and telemedicine law, including having a licensed practitioner involved before any prescription is issued; fill only on a valid prescription written by someone authorized to prescribe; disclose any criminal, regulatory or civil violations and any litigation, resolved or ongoing, over the prior ten years; make sure affiliates and partners comply with the same standards; process data over an encrypted connection; post a privacy policy where the law requires one; and advertise transparently, without misleading claims, in line with the advertising platforms' own policies. None of these is a surprise to an operator who has read the law. All of them are things a reviewer will check against documents rather than take on faith.

What it costs and how long it takes

The fee schedule on legitscript.com, as of this writing, has four parts. The application fee is $975 per website and is not refunded if the application is denied. The annual certification fee is $2,150 per website, due after approval and each year the certification is maintained. Expedited processing costs an additional $2,500 per application and commits LegitScript to starting the review within two business days of submission. A probationary certification, which LegitScript offers for merchants it will monitor more closely, has the same $975 application fee and a $3,995 annual fee per website that covers the deeper and more frequent monitoring.

LegitScript does not publish a standard, non-expedited processing time on that page, and it would be misleading to invent one here. What the expedited option tells you is that the start of the review is the part LegitScript can promise; the length of the review depends on the applicant. A file that arrives complete, with ownership, licensing and pharmacy documentation in the form the reviewer expects, moves through in a fraction of the time of a file that triggers three rounds of follow-up questions. Operators who report long timelines are usually describing the follow-up rounds, not the queue. Paying the expedited fee shortens the wait to start and does nothing about the wait for answers, so it makes sense only when the file is already clean.

Budget for the annual fee as a fixed cost of running paid acquisition, since losing certification means losing the ad accounts that depend on it. Certification also comes with ongoing monitoring: LegitScript watches certified sites for changes, and a claim added to a landing page six months after approval can trigger a notice just as it would have during the review.

What Google, Meta and the card networks each need

The certificate is a prerequisite, not a pass. Each platform layers its own policy on top, and the operator has to clear them one at a time.

Google's healthcare and medicines policy requires online pharmacies and telemedicine providers to be certified before running ads that promote prescription drugs, and it names LegitScript and NABP among the certifications it accepts. With the certificate in hand, the advertiser applies to Google separately, and Google's approval is country-specific and account-specific. The certificate gets the application considered; the account still has to match the certified domain and comply with the rest of Google's policy on healthcare content.

Meta treats prescription drug advertising under its Drugs and Pharmaceuticals policy, and its Health and Wellness ad standards add rules that apply regardless of certification: weight-loss ads must be targeted to adults eighteen and older, and before-and-after imagery is permitted only within limits. LegitScript lists Meta among the platforms that recognize its certification, along with Microsoft Bing, LinkedIn, TikTok, Netflix, Nextdoor and Yahoo. Recognition means the platform will use the certificate as evidence of legitimacy in its own review; it does not mean every certified merchant is automatically approved to run every kind of ad. The full sequence, including the pre-application checks that save the most time, is in the guide to getting approved on Meta and Google Ads.

Payment processing is the third gate, and the one operators underestimate. LegitScript states that Visa and Mastercard recognize its certification, and in practice acquiring banks and payment processors that onboard telehealth merchants ask for it as part of underwriting, because the card networks classify prescription-drug merchants as high risk. A processor may also ask for the same ownership and licensing documents the LegitScript file contains, plus reserve terms and chargeback history. Getting certified before applying for merchant processing, rather than after, removes a common reason for a processor to decline or to hold funds.

The documents to have ready

The application is a document exercise. The list below covers what reviewers generally ask a telemedicine applicant to produce, and assembling it before paying the application fee is the single biggest timeline lever available.

• Ownership and control: formation documents for the brand entity and the professional corporation, the management services agreement between them, and a chart showing who owns each entity and who holds clinical authority.
• Prescriber licensing: the licenses of the physicians and nurse practitioners who will see patients, matched to the states the site serves, with any collaborative practice or supervision agreements those states require.
• Pharmacy relationships: the licenses of every pharmacy that will fill for the brand, including out-of-state licenses for the states they ship into, and for compounded medication, evidence that the pharmacy operates as a 503A pharmacy or a 503B outsourcing facility in good standing.
• Clinical protocol: a description of the intake, the consultation, how a provider reviews each case before a prescription, and how the practice establishes a patient-provider relationship in the states it serves.
• Website content: a review of every page and every claim, the privacy policy, terms of service, telehealth consent language and the disclosure of the prescribing practice's identity.
• Compliance history: disclosure of any criminal, regulatory or civil matters and any litigation involving the entities or their principals in the prior ten years, even if resolved.
• Affiliate and partner list: any third party that markets the brand or sells through it, since the standards apply to them too.

The pattern in that list is that every item is something the business should already have in a finished state before launch. The MSO agreement exists because the corporate practice of medicine rules require it, not because LegitScript asked. The pharmacy licenses exist because shipping medication without them is illegal. LegitScript is checking that the structure is real. On Tessic Health's platform the MSO and friendly-PC documents are drafted for the client's ownership as part of setup, the pharmacy network is already licensed, and Tessic prepares and files the LegitScript application as part of the same setup, which is the main reason the certification is a milestone rather than a project for brands launched that way.

Where applications fail

Denials and long review cycles cluster in three places, and all three are structural rather than clerical.

Ownership is the first. A reviewer wants to see that the entity making clinical decisions is owned and controlled by licensed clinicians where state law requires it, and that the brand entity's control over the practice is limited to management. An application where the founder owns the professional corporation outright in a state that forbids it, where the management fee is a percentage of collections in a state that treats that as fee splitting, or where the management agreement gives the MSO authority over clinical protocols will draw questions that cannot be answered without redrafting. The MSO and friendly-PC explainer covers what a defensible structure looks like; the point here is that LegitScript will read the agreement.

Claims are the second. The advertising standard requires transparency and alignment with platform policy, and reviewers read the website as a consumer would. Copy that promises a specific amount of weight loss, presents compounded medication as equivalent to or interchangeable with an approved product, uses a brand-name drug to sell a compounded one, or implies that a prescription is guaranteed will fail, and it will fail again at Google and Meta if it somehow passes. The GLP-1 advertising compliance guide lists the patterns that draw notices, and the same discipline applies to hormone, hair, skin and sexual-health copy.

Pharmacy is the third. Every filling pharmacy has to be licensed in every state it ships into, and compounded products have to come from a 503A pharmacy compounding on a patient-specific prescription or a 503B facility registered with FDA. A brand that has been buying from a supplier that turns out to be unlicensed in half its states, or a peptide vendor with no pharmacy license at all, does not have a paperwork problem; it has a supply chain that cannot be certified. Reviewers also look at whether the drugs being sold are ones a legitimate practice would prescribe through telehealth at all, so a catalog with items that no licensed pharmacy would dispense is a denial on its own.

LegitScript is checking that the structure is real. If the ownership, the prescribers and the pharmacies are already clean, the application is paperwork; if they are not, no amount of paperwork fixes it.

Fitting it into the launch plan

Certification sits on the critical path to paid acquisition, and paid acquisition is usually how a new brand gets its first patients, so the application should go in as soon as the entities and the pharmacy relationships exist and before the website is finished. LegitScript reviews a live or staged site, so the pages it reviews should be the ones that will launch, with final copy. Filing against placeholder pages means re-review when the real pages go up.

A workable order: entities formed and the management agreement signed; prescribers credentialed and pharmacy contracts in place; site staged with final copy and legal pages; LegitScript application filed; merchant processing application filed in parallel with the same document set; Google and Meta certification applications filed as soon as the LegitScript decision arrives. Organic and owned channels, including email, a waiting list and creator content that does not run as paid ads, can start before the certificate, which is why brands that get their first hundred patients from a founder's audience feel the wait less. The launch timeline guide shows where the certification sits relative to everything else that has to happen.

One more timing note: the certificate is per domain, so a brand that plans to move from a placeholder domain to its real one should certify the real one. Changing domains after approval is a new application.

Questions operators ask

Does a brand need LegitScript if it only sells non-prescription products? For over-the-counter and wellness products the ad platforms' policies are different and generally do not require certification. The moment the site offers a consultation that can end in a prescription, it is a telemedicine provider in LegitScript's terms and in Google's, and certification is the route to prescription-drug advertising.

Can the brand run ads while the application is pending? Not ads that promote prescription treatment on Google, and Meta's review of a pharmacy or telehealth advertiser will ask the same question. Ads for the brand's non-prescription content, and organic content, are not blocked by the pending application.

Is the certification in the brand's name or the practice's? The certificate attaches to the website, and the application discloses both entities. The brand entity typically applies as the merchant operating the site, with the professional corporation disclosed as the prescribing practice. Either way, both sets of documents are in the file.

What happens at renewal? The annual fee is due, and LegitScript's monitoring continues through the year. Material changes such as a new pharmacy, a new vertical, a new domain or a change in ownership should be reported rather than discovered, since a monitoring finding can suspend the certification and, with it, the ad accounts.

Is the probationary tier a way in for a brand with a compliance history? It is LegitScript's mechanism for certifying a merchant it wants to watch more closely, at a higher annual fee. A brand with a disclosed past matter is better off disclosing it fully in the standard application and letting LegitScript decide which tier applies, rather than applying for probationary status pre-emptively or, worse, leaving the matter out of the ten-year disclosure.