Who Really Makes Your Compounded GLP-1

The short version: Many direct-to-consumer GLP-1 brands aren't medical companies at all. They're storefronts sitting on top of a rented platform that supplies the prescribers, the pharmacy, the intake form, and even the legal entity that employs your clinician. In February 2026, the FDA told one of these brands that putting its own name on a compounded GLP-1 label suggested it was the compounder "when in fact it is not." You can find out who's really behind your brand in about ten minutes, and we'll show you exactly where to look.

What did the TIME investigation actually find?

In August 2026, TIME published a piece on the rise of what it called telehealth "pill mills," describing an industry where a single software vendor can stand up a branded weight-loss clinic in days (TIME). The reporting names CareValidate as one of the companies powering these launches, and the company is fairly open about what that means.

CareValidate describes itself on its own homepage as "the data platform powering modern telehealth brands" and "the fastest way to build, launch, and scale digital health businesses." The first item in its feature list is "White-labeled: Full control of the patient experience" (CareValidate). Its provider network page is more blunt. It advertises "a nationwide network of providers, already built," and promises "White-Label Ready: Providers operate under your brand," with weight management and GLP-1 prescribing listed as a specialization (CareValidate provider network).

Two clarifications; first, no regulator or court has labeled CareValidate or any company named here a pill mill and there’s no evidence to say CareValidate offers a safety risk if companies use their services. The phrase ‘pill mill’ comes from an academic and from the title of a Senate report. Second, TIME writes that prescriptions were issued "often in as little as five minutes." The study behind that claim puts the figure at two of forty-five sites, which is 4.4% of the total sites studied. The median turnaround for prescription approval was one day or less.

What is a white-label telehealth platform?

Think of it the way you'd think about a store-brand cereal. The box is yours. The factory belongs to someone else, and it's filling boxes for a dozen other brands at the same time.

In telehealth, that rented factory usually comes in five layers:

A prescriber network licensed across all fifty states, credentialed and ready to work under your brand name.
Pharmacy and compounding fulfillment, meaning someone else's pharmacy actually makes and ships the drug.
Branded intake and records software, which is the questionnaire you filled out and the chart created from it.
Payments and subscription billing.
The corporate legal shell, typically a professional corporation paired with a management services organization. This is the layer most people have never heard of, and it's the one that matters most.

That last layer is sold as a product. OpenLoop Health markets a "50-State PC Network" alongside "PC groups, MSOs, incorporations and legal filing support," and its chief medical officer add-on offers to "create your own professional corporations" (OpenLoop). Its homepage tagline is "Your brand on the front, OpenLoop powering the back," and, more memorably, "Don't build it. Brand it" (OpenLoop homepage).

OpenLoop isn't unusual. MD Integrations lists "No charge for the Professional Corporation aka 'Medical Group'" and tells prospective partners that it provides the licensed provider network and clinical oversight, "removing the need for partners to hold individual licenses" (MD Integrations). LocumTele is the most candid of the bunch, warning buyers that a white-label platform "does not provide the clinical infrastructure, and in the U.S. regulatory environment, the clinical infrastructure is what the law actually requires" (LocumTele).

Who is the sales pitch aimed at?

Not doctors. Karpa Health's page for launching a white-label GLP-1 brand answers the question directly: "Do I need a medical license to launch a GLP-1 program? No." It names its buyers as med spa owners, gym owners, estheticians and chiropractors, publishes the unit economics down to "twenty-five patients generate about $6,250 per month," and promises that setup takes about twenty minutes and goes live the same day. It also states that "patients never see Karpa's name anywhere in the experience" (Karpa Health).

Bask Health pitches its platform as "built for entrepreneurs, doctors, and developers," with an intake builder "as simple as setting up a Shopify store" (Bask Health). MD Integrations ships actual Shopify and WooCommerce plugins.

None of this is illegal on its face, and some of these vendors are serving legitimate practices. But when the pitch deck for a weight-loss clinic leads with "no medical license required" and "live today," that tells you what the product is optimized for, and it isn't clinical depth.

What does a real example look like?

MedVi is the clearest documented case, and every fact here comes from either the company's own terms or an FDA letter.

The brand you'd see in an ad is MEDVi, selling a compounded GLP-1 product at $179 and a compounded GLP-1/GIP injection at $349. Its terms and conditions identify the binding entity as "MEDVi, LLC, a Delaware corporation located at 131 Continental Dr, Ste 305, Newark, DE 19713." The same document says MedVi "is not licensed to practice medicine," "is not acting as a pharmacy," and "does not produce compounded medications." It caps total liability at $100 and requires arbitration with a class-action waiver (MEDVi terms).

So who does treat you? The site footer says medical treatment is provided by "CareGLP Affiliated P.C.s" and "OpenLoop Health," and that "OpenLoop Health clinicians retain the decision to prescribe compounded GLP-1s to patients." CareGLP is CareValidate's GLP-1 product line. OpenLoop is a separate, competing white-label vendor. That's one consumer brand running on two different infrastructure companies, neither of them mentioned anywhere a shopper would look.

And the pharmacy? Never named. The site says only that it's "partnered with multiple USA certified pharmacies." There's no such regulatory category as a "USA certified pharmacy."

Four layers, one logo. If you'd bought from MedVi, you would not have been told the name of the company that employs your prescriber or the name of the pharmacy that made your medication.

What did the FDA say about that?

On February 20, 2026, the FDA sent MEDVi, LLC a warning letter alleging misbranding under sections 502(a) and 502(bb) of the Food, Drug, and Cosmetic Act. The line that should matter most to anyone holding a vial reads: the compounded products on the website "identify 'MEDVi' on the pictured label, suggesting MEDVi is the compounder of those drugs when in fact it is not" (FDA warning letter to MEDVi).

The FDA cited 21 CFR 201.1(h)(2), which treats an unqualified name on a drug label as a representation that the named company made it. The agency also asked MEDVi to respond by "identifying the entities that produce the compounded products offered on your website." Read that again. The regulator couldn't tell from the website who made the drug either.

MedVi wasn't singled out. That letter was part of a batch of thirty sent to telehealth companies, announced on March 3, 2026, though the letters themselves are dated February 20. The FDA said the companies were "obscuring product sourcing by advertising drug products branded with the telehealth firm's name or trademark without qualification, implying they are the compounder" (FDA press announcement). The agency has never published the full list of thirty recipients.

A second wave followed in June. The FDA's June 8, 2026 letter to Altru Telehealth flagged the claim "our compounding pharmacies are all FDA approved," and responded that the Act "does not establish an 'FDA-approved' or 'FDA-licensed' designation for pharmacies or outsourcing facilities" (FDA warning letter to Altru Telehealth). If a site tells you its pharmacy is FDA approved, it is describing something that does not exist. We covered the underlying pharmacy categories in our 503A versus 503B explainer.

One important caveat on all of the above: a warning letter is an allegation, not a court finding. It states the FDA's position and gives the company fifteen working days to respond.

Why isn't your prescriber employed by the brand?

Because in most states, it can't be. Roughly half of US states have corporate practice of medicine laws, which bar corporations owned by non-physicians from employing physicians or owning medical practices. The stated purpose is to keep business incentives out of clinical decisions.

The American Medical Association describes the standard workaround plainly. Physicians hold a professional corporation, investors hold a management services organization, and the MSO contracts with the PC. The AMA notes that "the line between what constitutes a clinical function and what constitutes a non-clinical function is blurry," and calls the "friendly PC" the most common loophole, in which an investor "typically secures a physician (or physicians) to control the practice who is sympathetic, i.e., 'friendly,' to the MSO." Its conclusion: "In effect, friendly PC arrangements allow corporations to assume control of physician practices" (AMA).

The AMA's concern in a separate brief is that lay employment of physicians drives "the commercialization of the practice of medicine" and "may interfere with the physician's independent medical judgement" (AMA issue brief).

Regulators are pushing back. California Attorney General Rob Bonta wrote in April 2026 that "MSOs are vendors and cannot own or operate medical practices, nor can they exert undue influence over licensed medical professionals," and applied a substance-over-form test: when an agreement lets an unlicensed corporation replace the physician-owner, "the corporation effectively owns the practice" (California Attorney General).

Oregon went first with legislation. Senate Bill 951 finds that "many business entities have sought to circumvent the ban through complex ownership structures, contracting practices and other means, particularly in recent years," and bans MSO control over things like how long a clinician may see a patient and over "advertising a professional medical entity's services under the name of an entity that is not a professional medical entity" (Oregon SB 951). That last clause is a direct hit on white-label branding.

There is a carve-out, and it is a large one. Oregon's law exempts entities "engaged in the practice of telemedicine" that have no physical location where patients receive care in the state. Pure-play direct-to-consumer telehealth, which is exactly the model this article is about, is largely carved out.

How much clinical review are you actually getting?

Yale researchers ran a secret-shopper study across forty-nine GLP-1 telehealth websites, published in JAMA on July 6, 2026. A single simulated patient went through each intake. The results are specific enough to list in full (JAMA):

Forty-five of forty-nine sites issued a GLP-1 prescription. Thirty-nine were for compounded product.
Only three of forty-nine, or 6.1%, required a call with a clinician at all.
Where a call or video visit did happen, the median length was nine minutes.
All forty-nine used a questionnaire, with a median of twenty-four questions.
Nine sites, or 20%, prescribed based on an upper-body photo when their own rules required a full-body photo or a photo on a scale.
Thirty-four sites, or 75.6%, automatically charged and shipped after approval without asking the patient to confirm.
Three clinicians prescribed to the same simulated patient through two or more different websites.
One site overturned a clinician's initial decision to deny the prescription.

That last bullet is the one we'd underline. A clinician said no and the platform said yes.

The authors' conclusion was that sellers are "demonstrat[ing] how sellers have justified continued compounding after the 2022-2025 GLP-1 RA shortages through individualization at scale." Individualization at scale is a contradiction, which is what the authors were driving at. We wrote about where the FDA may take that argument next in our piece on the FDA's move to limit compounded GLP-1 sourcing.

Reporting suggests the pace inside these operations can be brisk. STAT reported in July 2026 that former LifeMD workers said providers "at times were expected to review the cases of 25 people per hour based only on electronic forms the patients filled out," an allegation sourced to two of five former employees interviewed plus two lawsuits by former executives. LifeMD strenuously denies the allegations (STAT).

The pattern isn't limited to compounders. A 2025 Senate report on drugmakers' own direct-to-consumer platforms found that of patients routed by LillyDirect who saw a tele-provider, 74% received a prescription, including 100% of patients who had a virtual visit with one partner (US Senate report).

How do I find out who I'm actually buying from?

This is the part you can act on. Three different things get conflated in marketing, and only two of them give you any recourse: whether the website is certified, whether the pharmacy is licensed in your state, and whether the prescriber is licensed in your state. Work through these in order.

1. Read the terms of service and find the real entity

Open the terms and search for "LLC," "Inc.," "P.C.," "professional corporation," "is not licensed to practice medicine," "pharmacy," and "arbitration." You're looking for a name that isn't the brand name. In MedVi's case, that search surfaces MEDVi, LLC, CareGLP Affiliated P.C.s, OpenLoop Health, a $100 liability cap, and no pharmacy at all.

2. Look up the company

Most of these entities are Delaware companies. Delaware's entity search is free and gives you the file number, formation date and registered agent (Delaware Division of Corporations). The formation date is often the tell. A brand implying years of clinical heritage that incorporated fourteen months ago is telling you something.

3. Find the pharmacy name, then check your own state's board

This is the check that actually protects you. A mail-order pharmacy that ships into your state generally has to hold a non-resident license there. Florida's statute is a clean example: any out-of-state pharmacy that "ships, mails, or delivers a dispensed medicinal drug into this state shall be registered with the board," must disclose its principal corporate officers, and must print a toll-free line to a pharmacist on every label (Florida Statutes 465.0156). Florida's lookup even has a distinct "Nonresident Sterile Compounding" category (Florida license search).

The FDA maintains a directory of all fifty state board databases, with a blunt instruction attached: "If your online pharmacy is not listed, you should not use that pharmacy" (FDA state pharmacy directory). The National Association of Boards of Pharmacy explains the stakes: "Without a valid license, it is difficult (if not impossible) for state regulators to directly inspect or investigate claims of patient harm." We walked through this in more detail in why your pharmacy might not be licensed in your state.

4. Check your prescriber, and know where the gap is

The Federation of State Medical Boards runs DocInfo, which verifies licensure and shows whether a state board has taken action (DocInfo). One important limit: it covers physicians and physician assistants, not nurse practitioners. In the JAMA study, 34.7% of prescribers were advanced practice registered nurses, so DocInfo will miss roughly a third of them. For those, use your state board of nursing.

The CMS national provider registry is useful for pinning down an organization by name or authorized official (NPPES), but note its own disclaimer: "Issuance of an NPI does not ensure or validate that the Health Care Provider is Licensed or Credentialed."

5. Check the website itself, with realistic expectations

The one free public check that returns a straight answer is the NABP safe-site tool (NABP). It gives three verdicts: verified, not recommended, or not reviewed. Most telehealth brands come back "not reviewed," which is a default state and not evidence of wrongdoing. NABP also points out that a web address ending in .pharmacy is accredited and "cannot be faked or forged," unlike a logo image (NABP accreditation).

6. Look at the vial when it arrives

The FDA's own consumer page lists telehealth red flags including a product that looks different or arrives damaged, no licensed doctor available afterward, "spelling errors on the label or incorrect pharmacy addresses," and "a pharmacy name on the label you suspect is fraudulent." The agency has documented cases where the pharmacy named on a label didn't exist, and others where it named a real pharmacy that hadn't made the product. As of May 31, 2026, the FDA had received 990 adverse event reports for compounded GLP-1 products and more than 730 for compounded GLP-1/GIP products, and notes these are underreported (FDA).

Practical version: if the only name on your vial is the brand you bought from, that's the exact issue the FDA raised with MedVi. Find a pharmacy name, then run it through step three.

Do trust seals mean anything?

Less than you'd hope. LegitScript certification is real, but it's priced per website at $975 to apply plus $2,150 annually, and each domain needs its own application (LegitScript). Its practical function is unlocking Google and Meta advertising and card processing. CareValidate's own launch checklist offers to help clients "accelerate the LegitScript process," which tells you where the seal sits in the workflow.

There's also a usability problem we ran into ourselves. LegitScript's certification lookup is gated behind a CAPTCHA and returns no result on a direct link, so a consumer clicking a seal to audit it lands on a blank verification screen rather than a confirmation.

A seal on a checkout page tells you the website passed a paid review. It tells you nothing about whether the pharmacy filling your prescription is licensed where you live.

If something goes wrong, who do I call?

This is where the shell structure bites hardest. State medical boards can only act on an individual clinician you can name. The Medical Board of California requires "a separate complaint form for each physician" and states it has no jurisdiction over billing disputes or "general business practices (contracts, office policies, appointment times/duration, etc.)" (Medical Board of California).

So subscription billing, cancellation friction and advertising claims go to your state attorney general or the FTC instead. Those agencies do act. In July 2026 the FTC, joined by Utah and Los Angeles County, sued Hims & Hers over subscription billing and health data practices, alleging among other things that "Hims does not give most consumers a consultation with a provider" (FTC). That case is an allegation and will be decided by a court, and its headline claims are about privacy and billing rather than compounding. We broke down what subscribers should check in our coverage of that lawsuit.

Connecticut's attorney general has also settled cases against a business-to-business trade platform and a med spa over GLP-1 sales, with penalties largely suspended (Connecticut Attorney General). Those were negotiated settlements, not findings of liability.

The structural problem stands: a patient who never learns the name of the professional corporation treating them has no realistic way to file a board complaint against it.

Final Takeaway

The logo on your box is a marketing layer. Behind it there is usually a platform vendor, a professional corporation you have never heard of, and a pharmacy nobody named. That arrangement is legal, common, and mostly invisible by design.

You do not need to distrust telehealth to protect yourself. You need three names: the operating entity, the pharmacy, and your prescriber. If a company will give you all three, you can verify all three in about ten minutes. If it will not, that is the most useful thing you will learn about it.

If you enjoy posts like these, you can subscribe to receive newsletter updates.

Frequently Asked Questions

Does a white-label platform mean the company is a scam?

No, and we want to be careful here. Plenty of legitimate practices use outside infrastructure, and some of these vendors serve real clinics with real oversight. The problem is non-disclosure. If you can't find out who prescribes, who compounds and who you'd complain to, that's the red flag, not the existence of a vendor.

Is a compounded GLP-1 the same as Wegovy or Zepbound?

No. Compounded drugs are not FDA approved, and they are not reviewed for safety, effectiveness or quality before they reach you. The FDA specifically flagged "same active ingredient" style claims as misleading in its letter to MedVi. For the real differences between Ozempic, Wegovy, Mounjaro and Zepbound, start with our guide to what each GLP-1 actually does.

My brand shows a LegitScript seal. Isn't that enough?

It confirms a paid website review. It doesn't confirm that your pharmacy holds a license in your state, and that's the thing that determines whether a regulator can investigate if you're harmed.

What if my site won't tell me the pharmacy name?

That's an answer in itself. A pharmacy that ships to you generally has to be registered in your state, and in Florida it's actually unlawful for an unregistered non-resident pharmacy to advertise its services there. A company that won't name its pharmacy is a company you can't verify.

The Brand on Your GLP-1 Vial Probably Didn't Make It. Here's How to Find Out Who Did