Short answer: a med spa that only treats patients in person usually doesn't. A med spa that prescribes online, ships medication, or wants to advertise prescription drugs usually does. Most med spas in 2026 are drifting from the first group into the second without noticing, usually the day they add a weight loss program.
The three-question test
- Does anyone get a prescription without walking in? Telehealth consults, virtual follow-ups for GLP-1 or hormone refills, online intake that leads to a prescription. If yes, you're in LegitScript's scope.
- Does medication leave the building? Shipping to patients, or a pharmacy shipping on your behalf, puts you in scope.
- Do your ads name a prescription drug or prescription service? Semaglutide, tirzepatide, testosterone, "medical weight loss," "hormone therapy." Google and Meta restrict these categories to certified advertisers.
Three noes: you probably don't need LegitScript. Any yes: you probably do, for that part of the business.
Common med spa scenarios
| Scenario | LegitScript? |
|---|---|
| Botox, fillers, lasers, facials, all in person, ads say "wrinkle relaxer" and "injectables" | Usually no |
| Same, but ads name Botox or other neurotoxin brands | Platform restrictions apply; certification may not fix it. Most injectors advertise the service, not the drug. |
| In-person GLP-1 program, first visit in person, refills via video | Yes, once refills are prescribed remotely or ads name the drug |
| Online weight loss sign-up, telehealth consult, medication shipped | Yes |
| In-clinic IV drips only | Usually no |
| Mobile IV or at-home NAD+ kits | Depends on what's prescribed remotely and shipped. See mobile IV structure. |
| Selling prescription skincare (tretinoin, etc.) on your website | Yes |
| Hormone therapy with telehealth follow-ups | Yes. Testosterone adds DEA rules. See LegitScript for TRT. |
Where med spa applications fail
The owner isn't a physician
In corporate practice of medicine states, a lay-owned med spa can't own the medical practice. LegitScript's Legal Compliance standard looks at structure, so a med spa that's clinically fine can stall on ownership alone. The usual fix is a physician-owned professional entity with a management services agreement.
The medical director is a name on a form
Reviewers check that the prescriber is licensed in each patient's state and that protocols exist. A medical director who has never seen the protocols, or who is licensed in one state while the website serves five, is a problem. See our NP vs physician oversight guide.
The website says "nationwide"
Standard 5 requires your site to list every state you serve. For a single-location med spa adding telehealth, that list is usually one state. Say so.
RUO products in the retail case
Research-use-only peptides sold at the front desk or online will sink an application. See LegitScript and peptides.
What it costs a med spa
Same as anyone: $975 per website to apply, $2,150 a year per website once approved, optional $2,500 expedited review. One domain, standard review: $3,125 in year one.
If you run the med spa and the weight loss program on separate domains, that's two applications. Many med spas keep one domain with a /weight-loss/ section instead.
Med spa LegitScript checklist
If you answered yes to any of the three questions, work through this before applying.
Doing it in the right order
Most med spas apply in the wrong order: website first, structure last. The file then stalls on the first reviewer question about ownership or licensure. The order that works:
- Structure: physician ownership or a PC-MSO where your state needs one
- Medical director and protocols
- Prescriber licensure for every state you'll list
- Pharmacy and lab partners
- Website clean-up
- Apply
The full walk-through is in how to get LegitScript certified.
Where MDside fits
MDside is LegitScript certified. We provide medical direction, licensed prescribers, state-specific good faith exams and the PC-MSO structure med spas need when they add telehealth or weight loss. That's the part of the application reviewers test hardest.
Frequently asked questions
Do med spas need LegitScript certification?
Only if they prescribe remotely, ship medication, sell prescription products online, or advertise prescription drugs on platforms that require it. In-person-only med spas are generally outside LegitScript's scope.
Can a med spa advertise semaglutide on Google without LegitScript?
Generally no. Prescription drug and telehealth ads in the US require platform certification, which for most med spas means LegitScript first.
Can I advertise Botox on Google or Meta?
Neurotoxins are prescription drugs and brand-name drug ads are restricted. Most med spas advertise the treatment ("injectables," "wrinkle relaxers") rather than the brand. LegitScript certification doesn't automatically unlock prescription drug brand ads.
Does my med spa need a physician owner for LegitScript?
LegitScript checks that your structure is legal. In corporate practice of medicine states that usually means a physician-owned professional entity with a management services agreement.
How much does LegitScript cost for a med spa?
$975 per website to apply and $2,150 per website per year once approved. Expedited review is an extra $2,500.
Related reading
Sources
Adding weight loss or telehealth?
Get the medical direction and structure right before you apply.