Telehealth and med spa payment processing: how to get approved and stay approved
What underwriters look for, how reserves and holds work, the dispute thresholds that matter in 2026, and exactly what to do in the first 72 hours after a review.
Telehealth, med spa, and GLP-1 clinics are underwritten as high-risk merchants. That means approval takes one to four weeks with a dedicated healthcare processor, a rolling reserve is normal at the start, and an aggregator account opened in minutes can be reviewed, held, or closed once volume appears. The setup that survives is a dedicated merchant account, a complete underwriting packet, a second processor kept warm, and dispute handling that stays well under the card-network thresholds.
Reviewed September 11, 2026. Thresholds and timelines change; confirm current terms with your processor.
Telehealth payment processing at a glance
| Question | What to expect | Note |
|---|---|---|
| Risk classification | High-risk. Card-not-present, recurring billing, prescription-adjacent services, and subjective outcomes put telehealth and med spas in elevated merchant categories at most acquirers. | Applies regardless of processor |
| Approval timeline | Dedicated healthcare merchant account: typically 1 to 4 weeks after a complete packet. Aggregator sign-up: minutes, with underwriting deferred until after you are processing. | See the approval-time guide below |
| What underwriters ask for | Entity documents and EIN, owner ID, bank letter or voided check, 3 to 6 months of processing statements if any, licenses, website and billing disclosures, refund and cancellation policy, and for prescription models a LegitScript certification or application. | Full checklist below |
| Reserves | A rolling reserve commonly holds a percentage of each settlement for a set period. Terms are set at underwriting and can be revisited after a review. | Negotiable with history |
| Chargeback thresholds | As of 2026 Visa's VAMP program treats a 1.5% dispute-and-fraud ratio with at least 1,500 items in a month as excessive; Mastercard's program starts at a 1.5% ratio with 100 or more chargebacks in a month. Processors act well before those lines. | Confirm current figures with your acquirer |
| Recurring billing | Allowed with documented consent, clear descriptors, easy cancellation, and pre-billing notice. Memberships and refill programs are where most disputes originate. | Card-network rules apply |
| Backup processing | Expected. A second relationship, kept warm, is the difference between a hold being a nuisance and a hold stopping revenue. | Standard practice in the category |
Why do processors treat telehealth and med spas as high risk?
Because the money moves in the ways banks find hardest to defend. Every charge is card-not-present, so fraud liability sits with the merchant. Memberships, refill programs, and prepaid packages create recurring charges that patients later dispute as unauthorized or unwanted. Tickets are high, outcomes are subjective, and prescription-adjacent services draw regulatory attention that acquirers would rather avoid. When one clinic in the category has a bad month, the whole category is repriced.
None of this is a judgment about your business. It is how the industry is underwritten, and it is why general processors and healthcare merchant accounts behave so differently once you are live.
Aggregator account or dedicated healthcare merchant account?
Stripe, Square, and PayPal are aggregators: they board every merchant under their own master account, approve in minutes, and underwrite later. A dedicated high-risk or healthcare merchant account is underwritten first, through a sponsor bank, and issued in your name. The difference shows up at the worst possible time.
| Factor | Aggregator | Dedicated healthcare account |
|---|---|---|
| Time to first charge | Minutes | One to four weeks |
| When underwriting happens | After volume or disputes appear | Before boarding |
| Review, hold, or closure pattern | Common in healthcare once volume grows; often with little notice | Rare after approval; terms set in the agreement |
| Reserves | Can be imposed suddenly during a review | Set at underwriting, usually reduced with history |
| Descriptor and MCC control | Limited | Assigned to match the clinical model |
| Chargeback support | Self-service | Account team and dispute tooling |
| Best use | Bridge while a dedicated account is approved | The long-term arrangement |
If you are currently on an aggregator and things are fine, keep it and start the dedicated application anyway. Read how to get a merchant account for a telehealth clinic for the application itself.
What do telehealth merchant account underwriters ask for?
A complete packet is the single biggest factor in approval time. Every item below is asked for by most healthcare programs; assemble all of it before you apply rather than answering one request at a time.
- Formation documents, EIN letter, and ownership breakdown for anyone with 25% or more.
- Government ID for each principal, plus a personal guarantee in most high-risk programs.
- Bank letter or voided check for the settlement account, in the legal entity name.
- Three to six months of processing statements from any prior processor, including chargeback counts.
- Professional and facility licenses for the states you serve, and the medical director or supervising physician arrangement.
- Live website with the legal entity name, physical address, phone, refund and cancellation policy, privacy policy, and terms of service visible before checkout.
- A written description of the patient journey from intake to fulfillment, and who the merchant of record is if a pharmacy ships product.
- For GLP-1, hormone, peptide, or other prescription-adjacent models: LegitScript certification, or proof the application is filed.
- Projected monthly volume, average ticket, and the share of transactions that are recurring.
The full list with the reasons behind each item is in what documents telehealth underwriters require. If a processor has asked for certification specifically, see what a LegitScript request means.
How long does approval take, and what slows it down?
One to four weeks is typical for a dedicated healthcare account once the packet is complete. The slow cases share the same causes: a website that is not live or lacks policies, no processing history and no explanation for it, an unclear merchant of record between the clinic and a pharmacy, and prescription-adjacent products without a LegitScript application on file. Declines usually come from the same list, which is why a declined application is often fixable on the second try. Timelines by scenario are in how long high-risk healthcare approval takes.
How do reserves and holds work?
A rolling reserve withholds a percentage of each settlement and releases it after a fixed number of days, so the processor always has a cushion against disputes that arrive after the sale. It is set at underwriting for new healthcare accounts and is normally reduced, not removed, as clean history accumulates. A hold is different: it is a pause on payouts during a review, usually triggered by a volume spike, a dispute cluster, a descriptor mismatch, or a change in what the website sells. Terms, math, and negotiation points are in what a rolling reserve is for a healthcare merchant account. If payouts have already stopped, go straight to the 72-hour sequence below.
Which chargeback thresholds matter in 2026?
Two sets of numbers govern your account. The card networks publish program thresholds: as of April 2026 Visa treats a monthly dispute-and-fraud ratio of 1.5% with at least 1,500 items as excessive under its VAMP program, and Mastercard's excessive chargeback program begins at a 1.5% ratio with 100 or more chargebacks in a month. Those are the lines where fines start. The numbers that actually decide whether you keep the account are your processor's own, which are set well below the network levels, often under 1%, because your disputes count against the acquirer's portfolio too.
In this category almost every dispute traces to recurring billing: a refill charged after a patient thought they had canceled, a membership renewed without notice, a descriptor the patient did not recognize. The fixes are operational, not financial, and they are laid out in telehealth subscription payments: recurring billing, refills, and chargebacks.
What should I do in the first 72 hours after a review, hold, or closure?
Reviews are survivable when the response is fast, complete, and boring. Most accounts that are lost are lost to silence, partial answers, or changes made mid-review.
- 1Read the notice twice and write down the exact reason code and the deadline. Reviews, holds, and terminations are different processes with different clocks.
- 2Reply inside the processor's portal or ticket, not by a general support email, and confirm receipt in writing.
- 3Send every document they list in one complete package. Partial responses restart the queue.
- 4Do not change your business description, pricing, descriptors, or refund policy while the review is open. Mid-review changes read as evasion.
- 5Pause new marketing that would spike volume until the review closes; sudden volume is the most common trigger for a second look.
- 6Tell patients on active subscriptions how billing will continue, before a failed charge tells them for you.
- 7Open an application with a dedicated healthcare processor the same day, even if you expect the review to clear. Approval takes weeks; a hold does not wait.
- 8If the account is terminated, ask in writing for the reserve release schedule and the final settlement date, and keep processing records for the dispute window that follows.
Processor-specific walkthroughs: Stripe closed my telehealth account, Square is reviewing my med spa account, and switching processors without interrupting patient subscriptions.
How do I set up payment processing before launch?
In the order underwriters expect to see it. Founders who do these in this sequence are approved faster and hold their accounts longer.
- 1Decide the merchant of record for every charge: the clinic, the platform, or the pharmacy. Underwriters ask first.
- 2Form the entity, open the business bank account, and get the EIN letter before any application.
- 3Publish the website with policies, licensing disclosures, and the clinical model described plainly.
- 4Start LegitScript certification if any prescription-adjacent product or program is offered.
- 5Assemble the underwriting packet from the checklist above and keep it current.
- 6Apply to a dedicated healthcare or high-risk processor first; treat an aggregator as a bridge, not the plan.
- 7Set descriptors, receipts, and consent language for recurring plans before the first charge.
- 8Board a second processor once volume is steady, and route a share of traffic through it.
- 9Track disputes weekly against the network thresholds, and answer retrievals inside the deadline every time.
Program-specific eligibility notes: online weight-loss and GLP-1 clinics, TRT and hormone clinics, and who is the merchant of record when a pharmacy ships.
Reviews and holds
Respond inside the portal, in full, in one package, without changing the business mid-review. A second processor application goes in the same day.
Underwriting and risk category
Your MCC, descriptors, merchant of record, and processing history decide reserves and payout timing. Set them deliberately before the first charge.
Staying under the thresholds
Consent language, pre-billing notices, recognizable descriptors, and same-day retrieval responses keep disputes below the level where processors act.
Where MDLaunchr fits
MDLaunchr is a white-label telehealth platform, not a payment processor or a bank, and nothing here guarantees approval. What we do for clients is practical: build the underwriting packet from the checklist above, structure the merchant of record between the clinic and the pharmacy network, configure descriptors and consent flows on the platform, and introduce clients to processors that underwrite healthcare. If your payouts have stopped, the form at the bottom of this page goes to the payments queue rather than general inquiries.
Guides
Common questions
Why do payment processors flag telehealth and med spa businesses?
Because the category combines card-not-present charges, recurring billing, high tickets, prescription-adjacent products, and outcomes patients can dispute. Acquirers assign these businesses to elevated merchant category codes, and aggregators that boarded you in minutes underwrite you only after volume appears.
Can a telehealth clinic use Stripe, Square, or PayPal?
Many do at launch. Aggregators approve instantly and underwrite later, so healthcare accounts are more likely to face a review, a hold, or a closure once volume or disputes appear. A dedicated healthcare merchant account underwrites first and is the stable long-term arrangement.
How long does high-risk healthcare merchant account approval take?
Typically one to four weeks with a complete packet. Missing statements, an unfinished website, or an unclear merchant-of-record structure are the usual causes of a longer wait.
What is a rolling reserve and can I avoid it?
A rolling reserve holds a percentage of each settlement for a fixed period before releasing it, as a cushion against disputes. New healthcare accounts should expect one. Reserves are commonly reduced after months of clean processing history, not waived at signing.
What chargeback ratio gets a telehealth clinic in trouble?
The card networks publish excessive thresholds around 1.5% in 2026, but processors usually intervene below 1%. Refill programs and memberships are the main source of disputes, so consent, descriptors, and cancellation handling matter more than any single number.
Do I need LegitScript certification for GLP-1 or weight-loss telehealth?
Most sponsor banks and the major ad platforms require it for prescription-adjacent models. Underwriters will often accept proof that the application is filed while certification is pending, but the account may be limited until it is granted.
My processor is holding funds. Can MDLaunchr get them released?
No one outside the processor can force a release, and any company that promises to recover held funds should be treated with caution. What we do is help you respond completely, keep billing running through a second relationship, and set up a dedicated account so the next review is survivable.
Is MDLaunchr a payment processor?
No. MDLaunchr is a white-label telehealth platform. We help clients prepare the underwriting packet, structure the merchant of record, and introduce them to processors that underwrite healthcare. Approval decisions belong to the processor and its sponsor bank.
This content is for general informational purposes only, is not financial or legal advice, and does not speak on behalf of any payment processor or card network. Processor policies, network thresholds, and underwriting decisions vary and change; confirm current terms with your processor and consult qualified payments and legal counsel for guidance specific to your business.
Request a processing review
Dealing with a hold, a review, or a closed account, or setting up processing before launch? Tell us what happened and we will come back to you on next steps. This goes straight to our payments queue, separate from general inquiries.