Skip to content

LegitScript certification explained

What is discoverable about your business, and who finds it

A LegitScript review compares four accounts of a business against each other, and the one applicants underestimate is the public record, because archived pages, registry filings, app listings and a staging domain nobody retired are all reachable without asking you a single question.

By VeriScripts · · 5 min read

Applicants prepare the answers. Almost nobody prepares for the questions that never get asked, because the answer was already available. A review is an investigation, and an investigation starts with what can be established without troubling the subject.

This is not a list of anybody's methods, which nobody outside the certifier knows. It is a list of what is discoverable about a telehealth business by anyone competent and motivated, which is the right planning assumption.

Your own website, including the parts you forgot

The obvious surface, read more thoroughly than most teams expect. Not the navigation: every page reachable from anywhere, including landing page variants still receiving traffic, quiz result screens, the shop, the terms, and the pages that have not been touched since launch.

Also read with developer tools open. What loads on an intake page, which analytics and advertising tags fire, whether a chat widget is present on a page where a patient describes a condition. That is a privacy question before it is a certification question, and it is visible either way.

Everything the site used to say

Archived copies of web pages are trivially available. A claim removed last month is still legible, and so is the version of the business that existed before a pivot.

The practical consequence is not that old copy is held against you. It is that a discrepancy between what you say now and what you said then is a question, and a question you did not know was coming is answered badly. If your positioning has changed, be the one who says so.

The registrar and the DNS

Domain ownership, registration dates, name servers and the subdomains attached to them. This is where undisclosed properties surface: the staging site that is publicly reachable, the shortlink domain, the legacy brand from the pivot, the regional domain registered for a market you never entered.

Every one of those should be on your own list first. The complete file starts with the domain estate for exactly this reason, and pulling it from the registrar rather than from the marketing team is the whole of the technique.

Public registries and licence lookups

Corporate filings, officer records, registered agents, and the chain of ownership where entities own entities. Professional licence lookups by state. Pharmacy registrations and non-resident licensure. None of this requires your cooperation.

Which is why a coverage gap is the wrong thing to hope goes unnoticed. If you advertise into a state where no prescriber on your roster is licensed, that is visible from two databases and a targeting screenshot.

Enforcement and litigation records

Regulatory correspondence is frequently public. Our index of FDA warning letters covering compounded GLP-1 marketing exists because those letters are published, searchable and permanent, and it keeps the tally current. Board actions, consent orders and court filings are similarly reachable.

An open or historical matter attached to the business or a principal is not automatically fatal. Concealing one converts a difficult disclosure into a credibility problem that colours the entire file, which is the theme what disqualifies an application returns to repeatedly.

The channels you do not control but do benefit from

Affiliate and publisher pages driving into your funnel. Influencer and creator content. App store listings and their screenshots. Marketplace profiles. Review sites and the responses your support team wrote on them. Social accounts, including the one an agency ran two years ago and never handed back.

All of it is part of the marketing surface, and the claims on it are read the same way as the claims on your product page.

What your own team publishes about the business

This is the category nobody audits, and it is often the most candid account of the company anywhere.

Job listings describe the clinical model in plain language, sometimes more plainly than the website does. Funding announcements name entities and investors. Conference talks and podcast appearances describe how the intake actually works. A founder's professional profile lists the previous venture that the corporate filings also mention. Engineering blog posts name the fulfilment partner.

None of that is a problem in itself. It becomes one when it describes a different business from the one the application describes, and the usual cause is age rather than dishonesty: a job listing written eighteen months ago describes the model as it was then.

Before you file, read what your own company has published about itself in the last two years, and reconcile it. It is a two-hour job and it removes an entire category of question.

Your partners, from the other side

The pharmacy that dispenses, the provider network that contracts your clinicians, the platform that fulfils. Each has its own public record, and each is describing your relationship somewhere: on its own website, in its marketing, or in a filing.

Where those descriptions and yours differ, the difference is the finding. A clinic describing its partner as an outsourcing facility while the partner describes itself as a compounding pharmacy has created a discrepancy in its own file without either party saying anything untrue.

What to do about all of it

Run the exercise on yourself before anyone else does, and write down what you find rather than fixing as you go.

  • Search your brand, your product terms and your principals' names, and read three pages of results rather than one.
  • Pull the domain list from the registrar and resolve each one.
  • Look at archived copies of your product pages from a year ago.
  • Read your own licence and registration lookups.
  • Read what your partners say about you.
  • Read your affiliate and creator content as though somebody else wrote it, because somebody else did.

Most businesses find two or three things. Almost none of them are serious, and almost all of them would have cost a round trip during a review, which is the arithmetic the rework loop is built on.

Frequently asked questions

Will an old version of my website be held against me?

Old copy is not the problem. An unexplained difference between what a business says now and what it said before is, because it generates a question. If your positioning or product has changed, say so in the application rather than leaving it to be discovered.

Do I need to disclose a domain that only redirects?

A domain that merely redirects to a certified site generally does not need its own certification, but every domain the business owns should be disclosed. The distinction is between what gets certified and what gets declared, and the second list is always longer.

Should I mention a regulatory matter that was resolved years ago?

Yes. Resolved matters are usually still discoverable, and a disclosed one is a fact with context attached. One that is found after going unmentioned is a credibility problem that affects how the rest of the file is read.

General compliance information, not legal or medical advice.