Free tool
Is your website putting your spa at risk?
Marketing GLP-1s, peptides, and medical treatments comes with strict FDA and FTC rules, and most medspa websites break at least one of them without knowing. Run our free compliance check on your site and see what a regulator would see, in under a minute.
The compliance checker is an automated screening tool provided for general information. It does not constitute legal advice, and passing a scan does not guarantee regulatory compliance. Powered by healthycompliance.com, a SPA Healthcare tool.
Beyond your website
Telehealth marketing compliance in 2026: what changed
The GLP-1 boom pulled medspas into telehealth prescribing, and in 2026 the rules caught up. The drug shortages that made compounding routine are over, and the FDA has shifted its attention to how these programs are marketed online.
The GLP-1 shortage is over
Tirzepatide came off the FDA shortage list in October 2024 and semaglutide in February 2025, and the compounding grace periods closed in May 2025. Marketing compounded semaglutide or tirzepatide as a routine, cheaper substitute for the brand drugs is no longer shielded by shortage-era enforcement discretion. Legal compounding now hinges on a documented, patient-specific clinical need.
FDA is policing marketing, not just medicine
In mid-2026 the FDA sent a wave of warning letters to telehealth companies over compounded GLP-1 promotion. Regulators read a page as a whole: even accurate individual statements can misbrand a product if the overall impression suggests it is FDA approved or equivalent to the brand drug.
Reclassification is not approval
Headlines about peptides moving off the FDA's restricted compounding list do not make BPC-157, TB-500, and similar peptides legal to sell for human use. They remain unapproved and investigational, and disease or healing claims for them are still a violation.
The ground just shifted
The routine GLP-1 compounding window has closed, state boards disciplined telehealth-only prescribers in 2025, and the FDA sent 30 warning letters to GLP-1 telehealth firms in March 2026. This is not the year to improvise.
Where the risk is growing
Most of the risk on a medspa site is not the medicine, it is the words around it. These are the claims the FDA and FTC flag most often, and the ones our free checker looks for.
'Same as' and 'generic' claims
Calling a compounded product 'generic Ozempic', or saying it has the same active ingredient as an approved GLP-1, implies an equivalence the FDA has specifically warned against. Salt forms like semaglutide sodium or acetate are a different ingredient altogether.
Borrowed FDA approval
'FDA-approved', 'FDA-registered pharmacy', or '503B facility' language used to imply the drug itself is approved is a top target in recent warning letters. Facility registration is not product approval.
Benefits with no risk in sight
Promoting a drug's benefits with no side-effect information, or burying it in fine print and collapsed accordions, is classic misbranding. The FDA has logged more than 1,700 adverse events tied to compounded semaglutide and tirzepatide.
Guaranteed and overstated results
Specific pound-loss promises, money-back result guarantees, 'no side effects', and 'completely safe' all overstate what the evidence supports. Overstating efficacy and minimizing risk are named FDA concerns.
Testimonials and before/after photos
Dramatic success stories, influencer endorsements, and before/after imagery are promotional labeling. Under FTC rules they must reflect typical results and carry substantiation, and the 'results not typical' disclaimer no longer provides cover.
Off-label and unapproved substances
Microdosing or custom titration beyond the label, semaglutide for anti-aging or PCOS, retatrutide or cagrilintide, and research-use-only products sold for human use each carry their own enforcement risk.
What should be on a 2026 telehealth marketing audit
You do not need to wait for a warning letter or a consumer complaint. These are the reviews to run on your own site now.
Or skip the audit entirely. When you partner with SPA Healthcare, the clinical operation, the prescribing and the storefront claims sit with us and the licensed medical group. Your own advertising stays yours, which is exactly why this page exists.
- Read every drug page as a whole. Ask whether the overall impression could suggest the compounded product is FDA approved or equivalent to the brand drug, even when each sentence is technically true.
- Pair every benefit claim with clear, conspicuous risk information. No buried footers, low-contrast text, or collapsed accordions.
- Remove 'same as', 'generic', and 'FDA-approved' framing for compounded medications, and drop salt forms and non-compoundable molecules like retatrutide.
- Substantiate or remove testimonials, before/after photos, and result guarantees, and confirm any influencer content meets FTC endorsement rules.
- Confirm every prescription rests on a patient-specific, good-faith clinical evaluation, not an automatic subscription or a bare intake form.
- Strip disease and healing claims from any peptide marketing. Reclassification headlines do not make those products approved.
This page is general information for medspa owners, not legal, billing, or compliance advice.
Where each risk sits
Built compliance-first, so each risk sits with the party licensed to carry it
The model is designed to meet the rules rather than work around them. You do not prescribe, diagnose, dispense or hold patient health information, and you never buy, own or sell the medication, so the exposures that make telehealth risky sit elsewhere. Each party is responsible for what it actually does.
Corporate practice of medicine
Care sits with affiliated physician-owned groups, and SPA Healthcare operates as the management services organization. You never practice medicine.
Kickback and fee-splitting
You are the seller of record. You buy each program at a fixed wholesale price and set your own retail price, keeping the margin. No money changes hands for sending business, which is exactly what keeps it clean.
HIPAA
We hold all patient health information, you never do. Your reporting is aggregate and de-identified, and your staff never access patient records.
Staff boundaries
Scripted introductions only. No diagnosing, no medication recommendations, and no medical advice from your team.
Marketing and sourcing
No outcome guarantees, and no brand-name or FDA-approved claims for compounded product. Proper 503A and 503B sourcing only, with transparent pricing.
The honest part
What still sits with you
This is a narrower risk, not no risk. You are still the seller of the program and your team still talks to clients, so three things are worth a conversation with your own broker. None of this is a contractual requirement, and none of it is legal or insurance advice.
Your existing malpractice policy
Most spas already carry professional liability for their own practice. Ask your carrier one question: does the policy respond if a client alleges your front-desk staff gave medical advice about the program? The scripted introduction is designed to make that allegation fail, but your policy should not exclude it.
General liability, with personal and advertising injury
You almost certainly have this. It is the line that responds to a marketing claim, a trademark complaint from a drug manufacturer over an ad you ran, or a consumer claim about how the program was sold. You control your own marketing, so this is the cover standing behind it.
Cyber liability, if you do not carry it
You hold your clients' names and contact details as your own customer records. A breach of your systems is your breach, and notifiable under state law. Your existing practice records probably already justify the policy.
What you should not need to buy
- Products liability for the program, because you do not sell the medication
- Medical professional liability for the program, because you provide no clinical service under it
- Technology errors and omissions, because you operate no platform
If a broker tries to sell you more on account of the telehealth program, the four-party structure is the answer. SPA Healthcare maintains insurance appropriate to its role.
Found issues on your site?
Partner with us and the clinical compliance becomes our job. Your branded telehealth program, run by licensed clinicians, with the storefront claims handled.