Before You Pay an Online GLP-1 Clinic: A Practical Checklist

FDA lists warning signs for people buying GLP-1 drugs through telehealth. In summary, watch for a company that:

• claims a compounded drug is the same as an FDA-approved drug;
• offers “deep discounts or prices that seem too good to be true”;
• sends medicine that looks different from what you received before or from what its website showed, or that arrives damaged or without instructions for use;
• does not require a screening and prescription by a licensed doctor before providing medicine;
• has no licensed doctor available to answer questions after your medication arrives;
• uses labels with spelling errors or incorrect pharmacy addresses, or names a pharmacy you suspect is fraudulent.

Any of these is a reason to get answers before you pay.

1. The clinician’s license, in your state

Why it matters: HHS says health professionals must be “licensed or legally permitted to practice in the state where the patient is located.”

How to verify: Ask for the prescriber’s full name and credentials. State medical board profiles include at least “licensure status and disciplinary history,” according to the Federation of State Medical Boards (FSMB), whose free DocInfo database adds license history, medical school and specialty. For nurse practitioners, use your state board of nursing or NCSBN’s free Nursys QuickConfirm service; Nursys covers “RNs, LPN/VNs and APRNs” from participating boards.

2. Who actually prescribes and supplies the drug

Why it matters: The brand on the website may not be the company that compounds your medication. FDA’s March 3, 2026 warning letters to 30 telehealth companies cited “obscuring product sourcing” through branding that implied the telehealth firm was the compounder.

How to verify: Find the medical group’s legal name in the terms of service or consent forms, and confirm that a licensed clinician reviews your health information before anything is prescribed. FDA treats skipping “a screening and prescription by a licensed doctor” as a red flag.

3. The pharmacy’s name and license

Why it matters: FDA says patients should “fill the prescription at a state-licensed pharmacy.” A pharmacy the clinic will not name is a pharmacy you cannot check.

How to verify: Get the pharmacy’s legal name and state, then search the state license databases linked from FDA’s BeSafeRx page. FDA’s rule of thumb: “If your online pharmacy is not listed, you should not use that pharmacy.” For a claimed 503B outsourcing facility, check FDA’s registered outsourcing facility list. Our guide to 503A vs 503B pharmacies explains the difference.

4. FDA-approved or compounded

Why it matters: Compounded drugs are not FDA-approved, which FDA says means the agency “does not review their safety, effectiveness or quality before they are marketed.” They are not generics either, and FDA says companies cannot claim compounded products are generic versions of, or the same as, FDA-approved drugs, or “clinically proven to produce results for the patient.”

How to verify: Ask for the exact product and who makes or compounds it. FDA-approved brand-name and generic prescription drugs are listed in Drugs@FDA. Drugs from 503B outsourcing facilities must carry the label statement “This is a compounded drug.” Treat “same as,” “generic” or “FDA-approved pharmacy” wording as a reason to ask more: FDA says it “does not approve or license any facility.”

5. The full recurring charge and the billing interval

Why it matters: A price shown “per month” may reflect a calendar month, a shorter billing cycle or a prepaid plan divided by 12. A plan billed every four weeks, for example, charges 13 times a year, not 12 (our calculation: 52 weeks ÷ 4 = 13 charges).

How to verify: Before entering card details, note each recurring amount, how often it repeats, what it includes and any separate fees, and screenshot the checkout page. The federal Restore Online Shoppers’ Confidence Act (ROSCA) requires online sellers of automatically renewing plans to disclose “all material terms of the transaction before obtaining the consumer’s billing information.”

6. Whether the price changes with the dose

Why it matters: An introductory price may not apply to every dose or every month. If a clinic charges more for higher doses, your cost can rise as your prescription changes.

How to verify: Ask in writing whether the price is the same at every dose, when any introductory discount ends and what you will pay after that, and keep the reply. Our review criteria include whether a clinic says its price is the same at every dose.

7. What happens if a clinician declines you

Why it matters: If a clinic takes payment before a clinician reviews your intake, its refund rule decides what happens to your money when treatment is not prescribed.

How to verify: Find the sentence in the refund policy that covers declined or ineligible patients. Check whether the refund is full and automatic, how long it takes and whether consultation or intake fees are excluded.

8. Refunds, cancellation and auto-renewal

Why it matters: These terms decide what you pay if you stop: when a cancellation takes effect and whether prepaid months are refundable.

How to verify: Find the cancellation deadline before each billing date, the ways to cancel, whether shipped medication is refundable and whether any advertised guarantee appears in the policy itself. Save a copy of the terms.

Federal rules in 2026: The FTC’s 2024 “click-to-cancel” rule was vacated by the U.S. Court of Appeals for the Eighth Circuit on July 8, 2025. The FTC restored the rule’s pre-2024 form on February 12, 2026 and asked for public comment on whether to amend it on March 11, 2026; its rule page listed no new rule as of September 16, 2026. ROSCA still requires sellers to obtain “express informed consent” and provide “simple mechanisms for a consumer to stop recurring charges.”

9. Labs and health screening

Why it matters: Screening is how a prescriber decides whether a medication fits your health history, and FDA lists skipping a screening by a licensed doctor among its telehealth red flags.

How to verify: Ask what the intake covers, whether lab work is required, who orders and pays for it and whether the clinician may ask for recent results.

10. Follow-up and dose adjustments

Why it matters: FDA flags a company that “does not have a licensed doctor available to answer questions after you receive your medication.” FDA has also reported dosing errors tied to confusion between milliliters, milligrams and “units.”

How to verify: Ask how often a clinician checks in, how to reach one in between, how quickly they reply and who decides on dose changes. FDA encourages patients to talk with their health care provider or compounder “about how to measure and administer the intended dose.”

11. Side-effect support and FDA MedWatch

Why it matters: Compounded GLP-1s are not FDA-approved, and as of May 31, 2026, FDA had received 990 adverse event reports associated with compounded semaglutide and more than 730 associated with compounded tirzepatide. FDA notes it is “not always possible to determine if the adverse event directly resulted from use of the drug.”

How to verify: Ask who answers side-effect questions, during which hours, and what the clinic tells patients to do in an urgent situation. Patients and consumers can report side effects or product problems to FDA’s MedWatch program online or on Form FDA 3500B; FDA’s information line is 1-888-INFO-FDA (1-888-463-6332).

12. LegitScript certification, checked at the source

Why it matters: LegitScript’s healthcare certification standards include licensure, validity of prescriptions, privacy and transparency.

How to verify: Rather than trusting a badge image, enter the clinic’s web address on LegitScript’s status page, which shows whether a site is “LegitScript-certified, legitimate, or rogue.” Certification does not replace the license checks above.

13. BBB and Trustpilot, read for patterns

Why it matters: The BBB calls its grade “BBB’s opinion of how a business is likely to interact with its customers” and says a rating “is not a guarantee.” Trustpilot says its rating “isn’t just a simple average”: newer reviews carry more weight, and seven neutral reviews are built into the calculation.

How to verify: On BBB, read complaint details and company responses; “NR” (no rating) is “not a grade,” BBB says. On Trustpilot, read recent one-star reviews for repeated themes such as billing, shipping or cancellation, and note whether the business has claimed its profile and responds to feedback. Trustpilot’s calculation does not distinguish between “verified, invited, or unprompted reviews.”

14. Privacy: what HIPAA does and does not cover

Why it matters: HIPAA applies to covered entities (health plans, health care clearinghouses and health care providers that conduct certain transactions electronically) and their business associates; HHS says other entities do not “have to comply with the HIPAA Rules.” The FTC’s Health Breach Notification Rule covers some businesses outside HIPAA, such as apps and websites that hold consumers’ health information, and requires breach notices to “affected consumers, the FTC, and, in some cases, the media.”

How to verify: Read the privacy policy and any notice of privacy practices: which company collects your information, which partners receive it and whether it is sold. FDA’s BeSafeRx campaign lists a pharmacy site that “does not provide clear written protections of your personal and financial information” as a warning sign.

Before you pay, fill in a record like this and keep it with your screenshots.

To see how individual clinics handle these points, browse our GLP-1 clinic reviews and read how we review them.