How Should a Telehealth Brand Give an Ad Agency Access to Meta and Google?

What this means for you

• Your business owns the business portfolio, ad account, Page, dataset, domain and Google Ads account. The agency doesn't create them in its own portfolio for you.
• On Meta, add the agency as a partner from Settings, then Partners. Meta says only people with full control of the business portfolio can do this.
• On Google, accept the agency's manager account link request, or invite its people to your account at the access level they need.
• Keep at least two people inside your business with full control on Meta and admin access on Google.
• No shared passwords, and no agency employee's personal profile as the admin of your assets.

MedScale Health, a paid acquisition agency for telehealth brands and clinics, asks every new client for access this way. Ownership decides who can share assets, who can request a review and what happens when someone leaves. Every step below is taken from Meta's and Google's own help pages. This page is marketing guidance, not medical or legal advice. Platform policies change, so check the sources listed at the end before acting on a specific rule.

What the business should own

Create the business portfolio, ad account, Page and dataset in your own business, and keep the domain registered to the business. Meta's partner help page explains why the order matters: a partner given full control of an asset can manage everything, but it can't share that asset with another business. Only the organization that owns the asset can. Assets created in your portfolio and shared out stay yours whoever you hire next.

Prescription drug authorization follows the portfolio too. Meta says authorized advertisers can extend their authorization to run prescription drug ads to other ad accounts within the same business portfolio. A telehealth brand that keeps its ad accounts in its own portfolio keeps that option with them.

Meta: give the agency partner access

• 1. Turn on two-factor authentication for your business portfolio, which Meta lists as a step before you begin.
• 2. Ask the agency for its business portfolio ID. Meta says the partner must have a business portfolio and tell you its ID.
• 3. In Meta Business Suite, open Settings for your business portfolio and click Partners in the Users section. If you don't see Partners, Meta says you may not have full control.
• 4. Click Add, then Give a partner access to your assets, enter the agency's business portfolio ID and click Next.
• 5. Choose the assets and the level of access, then click Assign assets. Meta notes that someone else with full control may need to approve.

Choose partial access where you can. Meta describes partial access as permission to complete specific tasks, such as creating content, managing ads and responding to messages. An agency running ads needs the ads tasks on the ad account and access to the Page and dataset the ads use. It rarely needs full control of your business portfolio, which Meta describes as the highest level of access.

Keep two people with full control

Some actions belong to the business. Meta says business portfolio owners with full control can verify the business, and that a verification decision may take up to 14 business days. To request a review of a restricted advertising account in Business Support Home, Meta says you must be an admin on the account. Google warns that an account with only one administrator may lose access to its tags if that user becomes unavailable, and suggests adding at least one more. Two named people in the business, each with full control on Meta and admin access on Google, keep those actions available.

Google: link the agency's manager account

• The agency signs in to its manager account, selects Link existing account under sub-account settings and enters your Google Ads customer ID.
• Someone with administrative access to your account accepts the request under Access and security in the Admin menu, on the Managers tab.
• Alternatively, invite individual users under Access and security and choose each person's access level. Google notes that monthly invoicing or a credit line needs a user with Admin access.

Healthcare certification stays with your account. Google asks for healthcare applications at the child account level, not the manager account, with your customer ID and certified domain, and asks an agency applying on your behalf to send documentation of its relationship with you.

Why personal profiles and shared logins are a risk

Meta's Account Integrity policy says it may restrict or disable business assets, including Business Managers and ad accounts, that are owned by the same person or entity as an account that has been disabled, that were created or repurposed to evade a previous removal, or that show close linkage with a network of accounts that violate or evade its policies. When one person's profile is the only way into a business's assets and that profile is restricted, the business can lose access with it. A business-owned portfolio, two internal admins and partners attached as businesses spread that risk.

If an account is restricted, the fix is to find the cause, correct it and request a review. Never move access to another person's profile, or open a new portfolio or ad account, to get around a decision. Meta's policy lists assets used to evade its enforcement actions or review processes among those it may restrict.

When an agency leaves

• Remove the partner from your business portfolio's Partners settings. Meta's partner access page links the steps to remove a partner.
• Review integrations. Meta says people with apps and integrations permission can set up the Conversions API and create access tokens, so check what the agency set up and who holds it.
• In Google Ads, remove the agency's users under Access and security in the Admin menu, and ask the agency to unlink its manager account.
• Keep everything: ad accounts, Page, dataset, landing pages, creative files and reporting history all stay with the business.

What MedScale does

MedScale Health works only as a partner on accounts its clients own: partner access on Meta, a manager account link on Google, and no shared logins. At kickoff we check who holds full control and admin access, and recommend a second person where there is only one. MedScale tracks server-side under a BAA with neutral event names, and no names, emails, phone numbers, IP addresses or browser IDs go to any ad platform. No reinstatement or approval is promised. Book the free growth audit at medscale.health/audit, or see Ad Account Rescue at medscale.health/rescue if an account is already restricted.