Skip to content

LegitScript certification explained

What disqualifies a LegitScript application

Genuine disqualifiers are rarer than operators fear, and almost every common failure is fixable before submission, but the distinction decides whether a business fixes its website or stays out of the LegitScript queue altogether.

By VeriScripts · · 6 min read

Two very different things get called a disqualifier. One is a structural fact about the business that no amount of preparation changes. The other is a defect in how the business is presented, which is nearly always fixable and which accounts for most of the applications that fail.

Sorting your own situation into the right bucket is the first useful hour of work, because the two have opposite responses. A structural problem means changing the business or not applying yet. A presentation problem means fixing the website and applying properly.

Structural problems: change the business or wait

Dispensing without a valid prescription. A model where a patient can obtain a prescription-only medicine without a genuine prescribing decision by a licensed practitioner is not a compliance gap, it is the thing the certification exists to screen out.

Prescribers not licensed where the patient is. Telehealth is regulated at the state level in the United States, and prescribing into a state where the practitioner is not licensed is a problem the reviewer will find through licence lookups. Gaps in coverage against the states you actually market to are a disclosure item, not something to hope goes unnoticed.

Controlled substances without the framework for them. Prescribing controlled substances via telemedicine carries its own federal and state requirements. This is not automatically disqualifying, but a model that involves them without a documented framework is, and it is worth reading controlled substances and telehealth certification before deciding whether you are in this category.

A pharmacy partner that cannot be verified. If the dispensing pharmacy cannot be identified, is not registered where it operates, or is compounding outside what its registration permits, that is the application's problem as much as the pharmacy's.

Unresolved enforcement history. An open regulatory action against the business or a principal is not automatically fatal, but concealing one is. It is discoverable, and being found out converts a difficult disclosure into a credibility problem that colours everything else in the file.

Presentation problems: fix the site, then apply

This is where the volume is. None of the following is a reason not to be certified. All of them are reasons an application fails, and all of them are cheaper to fix before submission than during a review.

Claims that overstate what the product is. The largest single category. Describing a compounded drug as FDA approved, presenting it as equivalent to the brand-name product, or promising outcomes the compounded product was never reviewed for. Our index of FDA warning letters covering compounded GLP-1 marketing keeps the running count, and misbranding is the finding that runs through the series. The same language that draws a warning letter stalls a certification review.

Provider relationships described vaguely. Who prescribes, whether they are employed or contracted, what licences they hold and where. A site that says "our doctors" without ever naming a medical director or a licensing framework is making the reviewer do work.

Subscription and refund terms that are hard to find or hard to exit. Auto renewal buried in a checkout footnote, cancellation only by phone, refund policy that contradicts what the sales page implies. This is scrutinised more closely than most operators expect.

Missing or wrong privacy disclosures. A website privacy policy is not a Notice of Privacy Practices, and a covered entity needs the second one. Publishing one document and calling it both is a common and easily corrected miss.

Domains you did not mention. Every domain the business operates should be disclosed, whether or not you are certifying it. An undisclosed domain found during review is the worst version of a cheap problem.

Testimonials and before-and-after imagery doing claim work. A patient testimonial that states an outcome makes the claim just as surely as the marketing copy does, and the reviewer reads it the same way.

The category in between

Some things are neither, and they are worth naming because they generate the most anxiety and the least actual risk.

Being a new business is not disqualifying. Operating in a high-scrutiny category, weight management, hormone therapy, men's health, is not disqualifying, though it does mean a closer review. Using an asynchronous intake model is not automatically disqualifying where the states you operate in permit it, provided the model is described accurately.

Certification in these categories is normal. It is just less forgiving of a file that arrives incomplete.

How to audit your own site before you file

Take the claims first, because they are the largest category and the slowest to fix. Read every page a patient can reach, including the ones your ads point at and the ones nobody has looked at since launch, and ask of every sentence about a product whether you could evidence it to somebody who is not inclined to believe you.

Then take the four accounts of your business in turn, application, website, public record and partners, and check that they say the same thing about ownership, prescribing and fulfilment.

Then find the domains. All of them, including the ones on an old registrar account.

That is most of what a preparation engagement does, and it is entirely doable in house. What it is not is quick, and doing it after submission rather than before is what turns a short review into a long one.

A pre-submission checklist you can run in an afternoon

Work through it honestly and write down what you find rather than fixing as you go, because the list is more useful than the individual repairs.

  • Every domain the business owns, pulled from the registrar rather than from memory, with a decision recorded against each: certify, redirect, retire.
  • Every page a patient can reach, including live landing page variants, quiz result screens and the shop, read for claims.
  • Every product claim tested against the question: could you evidence this to somebody who is not inclined to believe you?
  • The provider roster, with licences and states, checked against the states you actually market in.
  • The dispensing pharmacy named as a legal entity, with its registration type and the states it may ship into.
  • The subscription terms, from a customer's point of view: what renews, when, at what amount, and how to stop without a phone call.
  • The privacy documents, checked for whether one document is standing in for two.
  • The application draft read alongside the website, looking for the sentence where the two describe the business differently.

What to do with what you find

Sort it into the two buckets this article opened with. Structural findings mean a conversation about the model before anything is filed, because the application fee is spent whatever the reviewer decides. Presentational findings go on an engineering and copywriting list with an owner and a date, and the application waits for them.

Filing while that list is outstanding is the most common self-inflicted delay in the whole process, because every unresolved item is a request for information waiting to be written.

Frequently asked questions

Is a denial permanent?

No. A denial is a decision on the application as filed, and refiling is possible. The application fee is nonrefundable regardless of outcome, so a refiling costs it again, which is why the cheapest application is the one that is right the first time.

Will operating in a high-scrutiny category get me denied?

No. Weight management, men's health and hormone categories are certified routinely. They attract a closer review, which means an incomplete file costs more time in those categories than in others.

Do I have to disclose domains I am not certifying?

Yes. Disclosure and certification are different questions. The certifier expects to know what the business operates, and an undisclosed domain discovered during review damages credibility across the whole file.

General compliance information, not legal or medical advice.