What LegitScript is, and what a new founder needs to understand about it

Most founders meet LegitScript the same way: an ad account gets rejected, the rejection notice mentions certification, and a search turns up a company in Portland, Oregon that nobody on the team has heard of. What is LegitScript, and why does a private company sit between a telehealth brand and its first Google or Meta campaign? The short answer is that the ad platforms and card networks outsourced a hard question, whether an online healthcare seller is legitimate, and LegitScript is the company they outsourced it to. The longer answer is worth a founder's time, because the certification is the gate to paid advertising for prescription products, and misunderstanding what it is causes more delay than the application itself.

This post explains LegitScript at the level a new founder needs: what the company is, what its healthcare certification covers, who relies on it, what it costs, what it does not do, and where it fits in a launch plan. The companion post on LegitScript certification for a telehealth brand goes deeper on the document list and why applications fail; this one is the orientation that should come first.

What LegitScript is

LegitScript is a private company, based in Portland, Oregon and founded in 2007 according to its own site, that provides monitoring, certification and investigation services for regulated online commerce. Its customers are the companies that carry risk when a bad seller gets through: search engines, social platforms and marketplaces that run ads, and payment facilitators and acquiring banks that process cards. Its about page names Google, Facebook and LinkedIn among the platforms that rely on it to vet sellers and advertisers, and describes services for payment facilitators, ISOs and acquiring banks alongside them.

Two facts follow from that. LegitScript is not a regulator. It does not issue licences, it does not enforce state law, and being certified by it changes nothing about a brand's obligations to a medical board, a pharmacy board, the FDA or the FTC. And LegitScript's customer is not the founder. The founder pays an application fee, but the service being sold is trust, and the buyer of that trust is the platform or the bank that wants a third party to have checked a seller's licences, ownership and claims before money moves. Understanding who the real customer is explains most of how the process feels.

What the certification covers

LegitScript offers several certification programs. The one a telehealth brand needs is healthcare merchant certification, which its site describes as serving pharmacies, telemedicine providers, medical spas, digital health platforms and pharmaceutical manufacturers. The certification is per website: a brand with two domains is applying twice.

The program is built on nine published standards. LegitScript names them as licensure and business registration, legal compliance, prior discipline and history, affiliates and partners, patient services, privacy, validity of prescription, transparency, and advertising. Read as a list, they describe a healthcare business the way a careful regulator would: properly licensed, run by people without a disciplinary record, transparent about who owns and operates it, careful with patient data, prescribing only on a valid patient-provider relationship, and advertising within the rules. A founder who can answer each of the nine with a document rather than a sentence is most of the way to certification.

The standard most first-time founders underestimate is transparency. LegitScript wants to know who is behind the website, which means the business entity, its owners, the medical practice that treats the patients, the clinicians who prescribe and the pharmacies that fill. A brand whose site never names its clinical operation, or whose ownership is hard to trace, is asking a reviewer to certify something the reviewer cannot see. The fix is not clever copy. It is a legal structure that exists on paper and a site that says so.

Who relies on it, and what that gets a brand

The healthcare certification page lists Google, Facebook, Microsoft, LinkedIn, Nextdoor, Visa and Mastercard as recognizing the certification, and elsewhere describes certification as enabling advertising on platforms including Google, Meta, Microsoft Bing, LinkedIn, TikTok, Netflix, Nextdoor and Yahoo. Google's own advertising policy, separately, requires certification for online pharmacies and telemedicine providers that want to run prescription-drug ads, and names LegitScript among the accreditors it accepts.

Practically, certification is what lets a prescription-product brand buy traffic. Without it, the ad platforms treat the brand as an unverified seller of regulated goods and the campaigns do not run, however clean the creative. The card networks' recognition matters for the same reason at the payment layer: a processor deciding whether to board a telehealth merchant, and on what reserve terms, often asks for the same certificate. The guide on getting approved for Meta and Google ads covers the platform side step by step.

LegitScript's own page adds a caution founders should take literally: each platform has its own ad policies and requirements, and the certification does not replace them. Certification opens the door. The platform's policy on claims, targeting, landing pages and product categories still decides whether a given ad runs. A brand can be certified and still have every GLP-1 ad rejected for a before-and-after image or a claim it cannot substantiate.

What it costs, and how long it takes

LegitScript publishes its fee schedule. As listed on its healthcare certification page: an application fee of $975 per website, nonrefundable; an annual certification fee of $2,150 per website; an optional expedited processing fee of $2,500, which the site says starts the review within two business days; and a probationary certification tier at $3,995 per website a year, which carries more frequent monitoring. Those are LegitScript's figures, not an estimate, and they can change, so the page is the source to check before budgeting.

The site does not publish a standard processing time. That absence is itself useful information: the review is a document review, and its length depends mostly on how complete the file is when it arrives and how many follow-up questions the reviewer has to ask. A complete file with clean licensure and a visible ownership structure leaves the reviewer fewer questions to ask, and the questions are where the calendar goes. The expedited fee buys a faster start, not a faster answer to an incomplete application.

The annual fee is the part to remember at renewal. Certification is a subscription, not a one-time stamp, and it comes with what LegitScript calls ongoing monitoring. A brand that adds a product line, changes a pharmacy, launches a second domain or changes ownership after certification has changed the thing that was certified, and the safe habit is to report those changes rather than let monitoring discover them.

LegitScript does not certify a website. It certifies that the business behind the website is licensed, traceable and honest about what it sells. The website is just where the reviewer starts.

What LegitScript is not

It is not a licence. A certified brand still needs licensed providers in every state it treats patients, a pharmacy licensed to ship into each of those states, and a legal structure that satisfies the corporate practice of medicine rules where they apply. Certification checks that those things exist; it does not create them.

It is not a legal opinion. LegitScript's review is conducted against its own standards, and passing it is not a finding that a brand complies with every state and federal rule. A founder should not read the certificate as a substitute for healthcare counsel, and a regulator will not either.

It is not an endorsement of the products. Certification says the seller is legitimate; it says nothing about whether a treatment works, and a brand that implies otherwise in its marketing has a claims problem the certification will not cover. The guide on what a brand can say when advertising GLP-1 products covers where those lines fall.

And it is not permanent. Certification is per website, renews annually, and sits on top of monitoring. A brand that treats it as a box ticked at launch tends to meet it again at the worst moment, usually when a campaign is paused for a review nobody expected.

Where it fits in a launch plan

The order matters. Certification comes after the legal structure, the provider network and the pharmacy relationships exist, because those are what the reviewer certifies. It comes before paid advertising, because the ad accounts will not run prescription-product campaigns without it. A founder who starts the application on day one of forming the company has nothing to submit; a founder who starts it the week the ads are ready to launch has added weeks to the launch.

• Form the business entity and settle who owns it, since ownership is the first thing the reviewer traces.
• Confirm the clinical structure: the medical practice, its licensed owner, the providers and their state licences.
• Confirm the pharmacy partners and their state licensing, including nonresident permits for the states the brand ships into.
• Build the website so it names the operator, the practice, the providers and the pharmacies, states the policies, and makes no claim the brand cannot support.
• Apply for certification, with the document set assembled before the fee is paid.
• Set up the ad accounts in parallel so they are ready to attach the certification the day it arrives.

On a platform that already runs the clinical operation, most of the list is already true when a brand signs. Tessic Health prepares and files the LegitScript application for each brand as part of setup, because the providers, the pharmacy network and the MSO and friendly-PC structure the reviewer checks are already in place and already documented. The founder's remaining work is the part only the founder can do: the business entity, the ownership answers and a website that tells the truth about all of it.

Questions operators ask

Is LegitScript required by law? No. It is a private certification. It is required in practice by the ad platforms and recognized by the card networks named on its site, which for a brand that depends on paid traffic amounts to the same thing.

Can a brand advertise without it? Not prescription products on the major platforms. Google's policy requires certification for telemedicine providers running prescription-drug ads, and the other platforms LegitScript lists apply comparable gates. Content marketing, search optimization and owned audiences do not require it, which is why brands often launch on those channels while the application is in review.

Does the certification transfer if a brand changes platforms? It attaches to the website and the business behind it. If the brand's website, entity and ownership stay the same and only the infrastructure partner changes, the brand should expect to report the change, since the providers and pharmacies the reviewer checked have changed. Whether a re-review follows is LegitScript's call under its monitoring terms.

What is probationary certification? LegitScript's site describes it as a tier with a higher annual fee and more in-depth and frequent monitoring. Its page does not list the conditions under which an applicant is placed there, so a founder offered it should ask the reviewer what triggered it and what would move the brand to standard certification.

Is the application fee refundable if the brand is not certified? LegitScript's page marks the application fee nonrefundable, which is one more reason to assemble the file before paying rather than after.