Payment Processing for GLP-1 Clinics: Underwriting Requirements

Payment processing for a GLP-1 clinic is decided by the acquiring bank and processor through private underwriting, based on the business model, clinical structure, billing practices, marketing, data handling, and financial risk. No federal GLP-1 merchant category or universal approval threshold exists, so preparation and state-specific review remain essential.

Payment processing for GLP-1 clinic at a glance

What do underwriters review for an online weight-loss clinic?

Underwriters review the clinic’s legal entity, licensed providers, states served, services sold, billing model, marketing, refunds, disputes, and technology environment. They are trying to understand what the customer buys, which entity performs each part, and when the customer is charged.

Separate clinical consultations, care-management or membership charges, fulfillment-related charges, shipping or administrative fees, and any charges made by an independent pharmacy or other entity. A brand or technology platform should not be presented as the clinician, prescriber, pharmacy, or regulator.

A useful application narrative explains the patient journey from marketing and intake through clinical evaluation, billing, fulfillment, support, cancellation, and refunds. Keep that description consistent across the website, contracts, processor application, checkout, receipts, and customer-service scripts.

For broader preparation, review this guide to obtaining a telehealth merchant account.

Is there a special federal merchant-account category for GLP-1 clinics?

No, federal sources do not establish a special federal “GLP-1 merchant category,” universal approval threshold, reserve percentage, or card-network fee. Processors and acquiring banks apply their own underwriting and risk policies.

Payment approval is separate from healthcare authorization. A merchant account does not establish authority to practice medicine, provide telehealth, prescribe, dispense, operate a pharmacy, or serve patients in every state.

State licensing, telehealth practice, medical-practice ownership, consumer-protection, subscription, privacy, pharmacy, and fulfillment rules may differ based on where the patient is located. A federally compliant operating model may still require a different structure or additional review in a particular state.

Can an online weight-loss clinic use recurring billing?

Yes, recurring billing may be commercially possible, but the clinic should disclose material terms, obtain express informed consent, and provide a simple cancellation mechanism under the FTC’s Restore Online Shoppers’ Confidence Act and the FTC’s amended Negative Option Rule, 16 C.F.R. Part 425.

The FTC announced the amended Negative Option Rule on October 16, 2024. Its current operative status as of September 16, 2026 should be verified in the eCFR and Federal Register because the approved research materials do not conclusively resolve subsequent litigation or agency action.

Before collecting billing information, show the price, billing interval, renewal terms, cancellation method, refund policy, and any commitment period. Do not use a general treatment acknowledgment or prechecked box as proof of recurring-billing consent. Keep timestamped records of the offer, consent, billing authorization, cancellation requests, and refunds.

The FTC also identifies ROSCA as requiring clear disclosure of material terms, express informed consent, and a simple way to stop recurring charges. Poor disclosures and difficult cancellation can produce disputes and additional underwriting scrutiny.

How do marketing claims affect GLP-1 clinic payment underwriting?

Marketing claims must be truthful and substantiated under Section 5 of the FTC Act, the FTC Health Products Compliance Guidance, and the Guides Concerning the Use of Endorsements and Testimonials in Advertising, 16 C.F.R. Part 255.

A testimonial does not eliminate the need to substantiate the underlying weight-loss or health-outcome claim. Endorsers must have actually used the represented service or product, and material connections must be clearly disclosed. The Consumer Reviews and Testimonials Rule became effective October 21, 2024 and addresses fake, false, or deceptive reviews and testimonials.

Prepare a controlled marketing file containing website and landing-page copy, paid advertisements, email and SMS campaigns, testimonials, reviews, influencer relationships, substantiation records, and approval or removal procedures. Do not assume that a disclaimer, medical supervision, or an FDA reference automatically makes a claim lawful.

The processor may ask for this material as part of its own business and risk review. That request is an operational underwriting practice, not a federal GLP-1 merchant-account rule.

What health-data controls should a clinic show a processor?

The clinic should map every place that health information may travel, including intake forms, appointment pages, patient portals, payment pages, analytics, session-recording tools, support systems, and advertising pixels.

Under the HIPAA Privacy Rule, including 45 C.F.R. § 164.502, a covered entity may disclose protected health information only as permitted and generally must limit disclosures to the minimum necessary. A vendor that creates, receives, maintains, or transmits PHI on behalf of a covered entity may be a business associate and generally requires a business-associate agreement. The HIPAA Security Rule, 45 C.F.R. Part 164, Subpart C, requires appropriate safeguards.

HHS guidance dated December 1, 2022 warns that online tracking technologies may expose identifiers, appointment information, billing information, or other PHI. A privacy-policy disclosure alone does not authorize a tracking tool to receive PHI. Tokenization or hosted checkout also does not automatically remove the clinic’s broader HIPAA responsibilities.

If the business operates a personal-health-record product, health app, or similar non-HIPAA platform, the FTC Health Breach Notification Rule, 16 C.F.R. Part 318, may also apply. The FTC’s 2024 amendments became effective July 29, 2024. For breaches involving 500 or more individuals, notification to the FTC is generally due at the same time as consumer notice and no later than 60 calendar days after discovery.

What should a GLP-1 clinic include in its underwriting packet?

The packet should include the following practical sections:

1. 1Entity and professional information: legal entity, ownership, operating names, tax information, business address, responsible providers, professional licenses, and states served.
2. 2Business-model narrative: services sold, responsible entity for each service, patient and provider locations, one-time and recurring charges, insurance billing, refunds, credits, and cancellation handling.
3. 3Clinical and fulfillment relationships: clinical-network information, independent pharmacy or fulfillment relationships, and clear separation of platform, clinical, and dispensing roles.
4. 4Marketing documentation: current website copy, advertisements, testimonials, reviews, influencer disclosures, and substantiation or approval records.
5. 5Data governance: HIPAA classification, business-associate arrangements where required, tracking and analytics review, incident response, and vendor data-retention practices.
6. 6Transaction controls: checkout screenshots, billing descriptors, receipts, refund policy, cancellation records, customer-support contacts, processing history, and chargeback or refund data.
7. 7Financial information: expected monthly volume, average ticket, seasonality, prior processing history, and requested settlement or reserve terms.

This is an underwriting-preparation checklist, not a federally mandated application. The acquirer may request additional information or apply requirements that are not publicly documented.

What changed recently?

The FTC Consumer Reviews and Testimonials Rule became effective October 21, 2024. FTC amendments to the Health Breach Notification Rule became effective July 29, 2024. On October 16, 2024, the FTC announced the amended Negative Option Rule covering recurring-billing disclosures, consent, and cancellation; its operative status should be rechecked as of publication. FTC materials dated September 25, 2025 and May 4, 2026 reflect continued enforcement attention to recurring billing and cancellation practices.

What do I do before applying for GLP-1 telehealth payment processing?

1. 1Founder: Define the legal entity, ownership, clinical relationships, states served, services sold, and every party involved in fulfillment.
2. 2Founder and platform: Map the customer journey, including marketing, intake, clinical service, billing, support, cancellation, refunds, and any separate fulfillment charge.
3. 3Counsel or compliance reviewer: Review state-specific licensure, telehealth, medical-practice ownership, advertising, subscription, privacy, pharmacy, and fulfillment issues.
4. 4Founder and marketing team: Assemble substantiation for health claims, testimonials, reviews, influencer relationships, and current advertisements under Section 5 of the FTC Act and applicable FTC guidance.
5. 5Platform and technology vendors: Map PHI and health-data flows, review tracking tools, determine business-associate status, and document safeguards and incident response.
6. 6Founder: Configure clear checkout terms, affirmative recurring consent, cancellation, refund handling, receipts, and statement descriptors.
7. 7Acquirer or processor: Ask for current eligibility rules, documentation requirements, settlement terms, reserve practices, and prohibited-activity definitions.
8. 8Founder and processor: Submit one consistent packet and respond to follow-up requests without describing the business differently across channels.

MDLaunchr is the brand behind WhiteLabelClinic.com, a white-label telehealth infrastructure platform—not a processor—that helps qualified businesses evaluate and coordinate technology, operational, compliance, clinical-network, and fulfillment relationships. Explore how MDLaunchr and WhiteLabelClinic.com can support a compliance-first telehealth launch. The white-label GLP-1 weight management program page covers the clinical and fulfillment side of the program.

Questions to ask your processor

• Does your current underwriting policy accept this clinic’s specific combination of clinical services, recurring charges, and fulfillment relationships?
• Which legal entities, licensed providers, states served, and affiliated organizations must appear in the application?
• What documentation do you require for recurring consent, cancellation, refunds, billing descriptors, and customer support?
• How do you define and review reserves, rolling holds, delayed settlement, or other account restrictions for this business model?
• Which website pages, advertisements, testimonials, reviews, or health claims must be submitted for review?
• What data-security, HIPAA, business-associate, or vendor documentation do you require for the intended checkout and support configuration?
• Which current card-network, acquirer, or processor rules apply, and where can we obtain the governing terms and figures?

Related reading: the full guide this article belongs to.