Does Your White-Label Telehealth Platform's LegitScript Cover Your Brand's Ads?

What this means for you

• LegitScript certifies root domains. If your ads send people to your own brand domain, that domain needs its own certification, whoever applies for it.
• Meta's prescription drug authorization asks for the URL certified by LegitScript. If that URL isn't certified or in good standing, the application can't go on.
• Google's healthcare application is made in the Google Ads account that runs the ads, with its customer ID and the certified domain.
• Microsoft requires online pharmacies and telemedicine providers that sell prescription drugs to be preapproved before their ads serve.
• While that is pending, Meta still lets you run ads that promote telehealth services generally, as long as they don't promote a prescription drug.

MedScale Health, a paid acquisition agency for telehealth brands and clinics, launches brands built on white-label telehealth platforms, where the platform provider runs intake, prescribing or pharmacy fulfilment behind the brand's own website. This page sets out what each ad platform checks and which domain the check lands on. This page is marketing guidance, not medical or legal advice. Platform policies change, so check the sources listed at the end before acting on a specific rule.

Why the platform's certificate is not yours

LegitScript's FAQ says Healthcare Certification applies to the root domain: if example.com is certified, shop.example.com and support.example.com are covered under the same certification. A different root domain is a different website. When a platform provider says it holds LegitScript certification, that tells you its own domains are certified. It does not tell you whether your brand's domain is.

LegitScript's own vocabulary fits the white-label model. Its FAQ describes a facilitator as a business that presents itself as the healthcare-facing business while third-party telemedicine providers or pharmacies deliver the care, and gives the example of a business that markets a treatment program under its own brand while relying on a partner network for consultations and fulfillment. The same FAQ says software platforms are usually not eligible unless they hold healthcare licensure, contract directly with providers or pharmacies, process payments for prescription drugs, or interact directly with patients.

Who applies, and what LegitScript wants disclosed

There are two routes to a certified brand domain. The brand can apply itself, or the platform provider can manage certification for the brands on its network. LegitScript says self sign-up and Enterprise Healthcare Certification lead to the same certification, and describes enterprise certification as built for organizations such as telehealth infrastructure providers that manage certification at scale. Ask the platform which route it uses and whether your root domain is on a certificate today.

Either way, LegitScript's standards reach past the brand. Applicants must provide all domain names and websites under their control and disclose all affiliates, and partner pharmacies responsible for fulfilment are generally required to be LegitScript-certified or accredited by another recognized body. Websites must clearly disclose every state where services are available. After certification, LegitScript asks to be told about changes in ownership, partnerships, new services and expansion into new jurisdictions, which matters when a brand changes platform or pharmacy.

What Meta checks

Meta's help page defines telehealth providers as entities that promote or facilitate access to online health-related services, such as prescribing, and requires them to be actively certified with LegitScript before applying for prescription drug authorization. In the application you provide the website URL that has been certified by LegitScript. Meta's note is blunt: if the URL you provide has not been certified or is not in good standing with LegitScript, you will not be able to proceed. You then choose the ad accounts to authorize.

Authorization stays inside a business portfolio. Meta lets authorized advertisers extend authorization to other ad accounts within the same business portfolio, so a platform's authorization in its own portfolio does not reach an ad account in yours. To keep authorization you must maintain an active LegitScript certification, and Meta says it may be revoked if you no longer have one. Ads that only promote telehealth services generally need no authorization, so service ads can run while the application is in progress.

What Google and Microsoft check

Google requires advertisers to be certified by Google to serve ads for prescription drug services, and in the US it allows telemedicine providers accredited by LegitScript's Healthcare Merchant Certification Program. The application is made at the child account level, not the manager account, with the Google Ads customer ID and the certified domain. Google adds that it errs on the side of caution with landing pages that link or refer to anything that appears to facilitate online prescribing, so a brand page that links to the platform's intake is in scope even if the ad names no drug.

Microsoft Advertising says online pharmacies, telemedicine providers that sell prescription drugs and prescription drug manufacturers must be preapproved before their ads serve, starting with its Pharmacy and Telemedicine advertiser program form. Its US rules say online pharmacies advertising prescription drugs must be accredited by NABP or LegitScript, and ask advertisers using LegitScript to add the certification badge to the site before appealing disapprovals.

What to ask the platform provider

• Is my root domain certified by LegitScript today, and under whose application? Check it yourself on LegitScript's Website Certification Status lookup.
• Which pharmacies fulfil my orders, and are they LegitScript-certified or accredited?
• Which states are the prescribing clinicians licensed in, and does my website list them?
• Who tells LegitScript when my offer, pharmacy or states change?
• Which domains does a patient pass through between my ad and checkout?

The order of filings

When the platform runs intake and pharmacy, we work in this order. First, confirm or obtain certification for the brand's root domain, with every domain in the patient path disclosed. Second, request Meta authorization from the brand's own business portfolio with that URL. Third, apply for Google healthcare certification in the brand's own Google Ads account. Fourth, submit Microsoft's preapproval form if Bing is in the plan. Meta ads for the service that promote no prescription drug can run from the first week.

What MedScale does

MedScale Health checks the certification status of every domain in a white-label brand's patient path before building drug-named ads, files the Meta, Google and Microsoft applications in the brand's own accounts, and runs service ads while they are pending. The brand owns every ad account. MedScale tracks server-side under a BAA with neutral event names, and no names, emails, phone numbers, IP addresses or browser IDs go to any ad platform. No approval date is promised. Book the free growth audit at medscale.health/audit for a written plan.