LegitScript Certification for UK Pharmacies: A Complete Application Guide

A comprehensive preparation and application guide for online pharmacies, pharmacy-led online clinics and remote prescribing services

Last checked: 3 November 2026

LegitScript Healthcare Merchant Certification is an independent compliance review. Advertising platforms, payment providers and card networks use it when assessing certain pharmacies, online prescribing services and other healthcare businesses.

For a UK pharmacy, opening the form is the easy part. The real work is deciding whether the certification fits the service, identifying every organisation involved in the patient journey, and making sure the website, registrations, prescribing process, dispensing arrangements and advertising all describe the same service.

This guide explains how to prepare, apply and respond to the review. It is written in practical UK pharmacy language for owners, Superintendent Pharmacists, pharmacist prescribers and the people responsible for an online clinic.

It is not legal advice or a substitute for guidance from LegitScript or the appropriate pharmacy, healthcare, medicines, advertising, data-protection and professional regulators.

Who this guide is for

It is most relevant to:

• an independent community pharmacy adding a private online clinic;
• an online or distance-selling pharmacy providing remote services;
• a pharmacy group operating one patient-facing clinic website across several branches;
• a pharmacy-led service using pharmacist, doctor or nurse prescribers;
• a digital-health brand working with a partner prescribing service or dispensing pharmacy; and
• a pharmacy asked for LegitScript certification by Google, another advertising platform, an acquiring bank or a payment provider.

A community pharmacy providing ordinary face-to-face services, NHS dispensing or a simple information website may not need LegitScript. The answer depends on the online service, payment flow, target market and platform—not on the word “pharmacy” alone.

LegitScript at a glance

What is LegitScript?

LegitScript is a private compliance and certification company. Its Healthcare Merchant Certification programme reviews pharmacies, remote prescribing services—often called telemedicine by advertising platforms—digital-health platforms, medicine facilitators and certain other healthcare businesses.

LegitScript is not a UK healthcare regulator. It does not register a pharmacy, license a medicine, authorise a prescriber or replace a statutory inspection. Instead, it gives participating advertising platforms, payment providers and card networks an independent assessment they can use when deciding whether to work with the business.

The review looks beyond the appearance of a website. LegitScript's published standards examine:

• whether the business, pharmacy and practitioners hold the required registrations and licences;
• whether the service complies with the laws and regulatory requirements of every jurisdiction it serves;
• the history of the business, its principals and associated practitioners;
• partner pharmacies, prescribers, suppliers, affiliates and connected companies;
• the safety and transparency of patient services;
• privacy and security—supported by a proportionate pharmacy cybersecurity plan;
• whether medicines are supplied only against valid prescriptions;
• whether claims, prices, roles and financial arrangements are presented accurately; and
• whether advertising complies with applicable law and platform rules.

Certification therefore answers a narrower question than “is this a good pharmacy?” It indicates that LegitScript has reviewed the submitted business and domain against its certification standards and that the business remains subject to ongoing monitoring. It is not a guarantee of clinical outcomes, advertising performance or approval by every payment or advertising platform.

Why is LegitScript important for pharmacies?

Online pharmacy and prescribing models combine several areas that advertising and payment companies regard as higher risk: regulated medicines, remote consultations, sensitive health information, online payments and services delivered through several organisations. A platform cannot always tell from the website alone whether the pharmacy, prescriber, medicine supply and payment journey are lawful and transparent.

LegitScript can matter in five practical ways.

1. Access to healthcare advertising

Major advertising platforms restrict pharmacy, prescription-service and telemedicine advertising. Some use LegitScript certification as a prerequisite for particular business models or countries.

For example, Google's current UK policy specifically requires LegitScript certification for telemedicine providers promoting prescription drug services. Pharmacy owners planning paid search can also use our Google Ads for pharmacies guide to understand the wider account, landing-page and campaign controls. Certification does not automatically approve a Google Ads account or an individual advertisement—the business must still complete Google's healthcare certification and comply with its advertising policies—but it can provide the third-party verification needed to enter that process.

2. Payment processing and online transactions

Pharmacies that take online payments for regulated medicines or prescription services may receive additional scrutiny from acquiring banks, card networks and payment processors. The industry term is a “card-not-present” transaction: the patient pays online rather than presenting a physical card in the pharmacy. LegitScript says its certification is recognised by Visa and Mastercard and may form part of the evidence used for higher-risk merchant registration.

Certification does not force a payment provider to accept a business. It can, however, give the provider a recognised compliance assessment instead of asking it to evaluate the entire healthcare model from first principles.

3. Verification of a complex patient pathway

An online service may involve one company owning the website, another employing the prescriber, a partner pharmacy dispensing the medicine and a separate provider taking payment or making the delivery. LegitScript requires those relationships to be disclosed and assesses organisations that are essential to the patient journey.

This makes certification particularly relevant to pharmacy-led online clinics, marketplace models and businesses that contract with external prescribers or fulfilment pharmacies.

4. Identifying compliance gaps before they become commercial problems

The application can expose inconsistencies that may also concern regulators, advertising platforms or payment providers: missing homepage disclosures, expired registrations, unclear partner responsibilities, non-compliant POM promotion, unsupported jurisdictions or a mismatch between the live website and the documented clinical process.

Certification should not be treated as a substitute for the pharmacy's own governance. Used properly, the preparation work can provide a structured check across the website, patient journey, registrations, contracts, advertising and payment arrangements.

5. Ongoing assurance for partners and patients

Approved businesses can display LegitScript's certification seal and appear in its verification system, subject to the programme's rules. This can help partners and patients distinguish an independently reviewed business from an anonymous or inadequately transparent medicine website.

The value of the seal depends on continued compliance. Certification is monitored and can be denied, suspended or revoked if the business no longer meets the standards.

What LegitScript certification does not do

It does not:

• replace GPhC or Pharmaceutical Society of Northern Ireland pharmacy registration and professional standards;
• replace registration with the relevant independent-healthcare regulator where the activity requires it;
• authorise a medicine or an off-label claim;
• make public advertising of prescription-only medicines permissible;
• guarantee Google, Meta, Microsoft or another platform will approve an account or advertisement;
• guarantee a bank or payment provider will offer services;
• approve an individual clinical decision; or
• remove the pharmacy owner's and Superintendent Pharmacist's responsibility for safe and effective services.

The most useful way to view LegitScript is as a commercially important independent compliance gateway. For some pharmacy models it is necessary to access particular advertising or payment opportunities. For others it may be optional or unnecessary. That is why confirming the correct category and requirement comes before paying the application fee.

The UK regulatory picture

“UK pharmacy” does not mean one regulator covers every part of the service. Pharmacy regulation and independent-healthcare regulation differ across the four nations.

Doctors are regulated by the GMC across the UK. Pharmacist prescribers are regulated by the GPhC in Great Britain and PSNI in Northern Ireland. Nurse prescribers are regulated by the Nursing and Midwifery Council. Other prescribers remain accountable to their own professional regulator.

Whether an online provider needs registration with CQC, HIS, HIW or RQIA depends on the activity, provider structure and nation. Check the position for the actual service rather than copying an England-only checklist.

LegitScript's published UK checklist refers mainly to GPhC and CQC evidence. A Scottish, Welsh or Northern Irish applicant should provide the equivalent evidence that applies to its service and confirm the correct documents with LegitScript. The GMC's summary of remote-prescribing principles lists the four national service regulators, while the GPhC and PSNI explain their respective pharmacy roles.

UK terminology note: an NHS “distance-selling pharmacy” is a particular contractual model in England. It is not a general label for every pharmacy with a website or delivery service. NHS contractual status does not, by itself, decide whether LegitScript is required.

The first question: do you actually need LegitScript?

Do not assume that every UK online pharmacy needs LegitScript for every advertising platform.

Google's current UK policy distinguishes between:

• Online pharmacies: Google says they may be promoted if they are registered with the GPhC. The advertiser must also complete Google's own healthcare certification. Prescription-only medicines must not be promoted in the ads or landing pages.
• Telemedicine providers: Google says businesses promoting prescription drug services through telemedicine must hold LegitScript Healthcare Merchant Certification. The advertiser must then complete Google's own healthcare certification as a separate step.

See Google's current Healthcare and medicines policy and healthcare certification application guidance.

The boundary depends on what the website actually does, not what the business calls itself. A registered pharmacy that simply accepts prescription requests or sells permitted pharmacy products may be assessed differently from a pharmacy-led platform that provides remote consultations, facilitates prescribing, takes payment for a prescription service and arranges dispensing.

Google's wording refers to GPhC registration, while pharmacies in Northern Ireland are regulated by PSNI. A Northern Irish pharmacy should obtain platform-specific confirmation rather than assuming that a GPhC-based route applies unchanged.

A quick pharmacy-owner decision table

LegitScript may also be relevant when:

• a payment processor, acquiring bank or card network requests it;
• the business wants access to an advertising platform that recognises LegitScript;
• the website processes card-not-present transactions connected with prescription medicines;
• the business acts as a broker, marketplace or facilitator between patients, prescribers and pharmacies;
• a partner organisation requires all pharmacies in its network to be certified; or
• the business operates in, or markets to, another country where the applicable rules are different.

LegitScript says its Healthcare Certification is intended for businesses involved in the online sale, prescribing, facilitation or payment processing of prescription medicines and certain over-the-counter medicines. Its current eligibility guidance also covers internet and bricks-and-mortar pharmacies, telemedicine providers, digital-health platforms, pharmacy facilitators and some other healthcare merchants. Review the Healthcare Certification overview and Healthcare Certification FAQ before paying.

A practical scope test

Before applying, write down:

1. What the patient can do on the website.
2. Whether the patient receives a clinical consultation.
3. Who employs or contracts with the prescriber.
4. Who makes the prescribing decision.
5. Which registered pharmacy dispenses the medicine.
6. Who takes the patient's payment and what that payment covers.
7. Which company owns each website and patient record.
8. Which countries the service accepts patients from.
9. Which organisation is responsible when something goes wrong.

Send a short description of the model to certification@legitscript.com if the correct route is unclear. Clarifying eligibility before paying matters because the standard application fee is non-refundable.

LegitScript fees and timing

LegitScript currently publishes the following standard Healthcare Certification fees. Charges are in US dollars:

The application fee starts the review and is non-refundable. The annual fee becomes due only if the application is approved.

A root domain is the main website address, such as examplepharmacy.co.uk. Pages beneath it and subdomains such as clinic.examplepharmacy.co.uk are normally covered by the root domain. A separate main address usually attracts another set of fees. Businesses with several entities, websites, locations, prescribers or pharmacy partners may be directed to an enterprise route.

LegitScript does not publish a standard completion time. Review duration depends on the complexity of the model, the completeness of the evidence, application volumes and how quickly the applicant answers questions. Paying for expedited processing means LegitScript will start the review within two business days after screening; it does not guarantee approval or shorten the substantive compliance review.

Check the current figures before paying because pricing can change: Healthcare Certification pricing and general certification FAQ.

The nine standards your business must meet

LegitScript's published Healthcare Certification Standards cover nine areas:

1. Licences, professional registrations and business registration — the business and practitioners must hold the permissions needed for the services and every jurisdiction served. LegitScript calls this “licensure”.
2. Legal compliance — prescribing, dispensing, medicines and business operations must comply with applicable law and regulatory requirements.
3. Prior discipline and history — the business, principals and relevant practitioners must disclose criminal, civil and regulatory history.
4. Affiliates and partners — connected businesses, prescribers, dispensing pharmacies, suppliers and other material partners must operate legally and comply with the programme.
5. Patient services — the website must clearly state where services are available and must support a lawful, safe patient pathway.
6. Privacy — personal and health information must be handled under applicable privacy law and protected in transit.
7. Validity of prescription — medicines may only be dispensed against a valid prescription from an authorised prescriber following appropriate care.
8. Transparency — claims, prices, roles, treatments and transactions must be accurate and not misleading.
9. Advertising — advertising must comply with applicable law, regulation and platform policy.

Certification is therefore a business-wide review. A compliant footer alone cannot compensate for an unclear prescribing model, an undisclosed partner pharmacy or non-compliant advertising.

Build the application team

Nominate one application owner, but do not leave the review to marketing alone. A useful team normally includes:

• the pharmacy owner or accountable director;
• the Superintendent Pharmacist, where applicable;
• the clinical or prescribing lead;
• an information-governance or data-protection lead;
• the website or technical lead;
• whoever owns advertising and affiliate relationships;
• finance or payments staff; and
• a representative from any partner prescriber or dispensing pharmacy.

Create one evidence register with a filename, owner, expiry date and application section for every document. This reduces contradictory uploads and prevents expired registrations from being submitted.

The evidence pack to prepare

The current UK application checklist and application questionnaire indicate that applicants should be ready to provide the following.

1. Corporate identity and ownership

Prepare:

• the exact registered company name, number and registered office shown at Companies House;
• trading names and previous names;
• directors, principals, officers and beneficial owners;
• an organisation chart where more than one entity is involved;
• every root domain, subdomain and app used in the patient journey;
• the legal entity that owns each domain;
• payment processors, merchant accounts and acquiring relationships;
• a plain-English business-model description; and
• details of related or co-owned healthcare businesses.

Names and addresses should match across Companies House, the relevant pharmacy and healthcare regulators, the ICO, website terms, payment accounts and the application. Explain legitimate differences instead of leaving the analyst to work them out.

2. Pharmacy and practitioner registrations

Depending on the model and UK nation, prepare:

• GPhC registration details for every dispensing pharmacy in England, Scotland or Wales;
• PSNI registration details for pharmacies and pharmacists in Northern Ireland;
• GPhC or PSNI details for relevant pharmacists, including Pharmacist Independent Prescribers;
• the pharmacy owner and Superintendent Pharmacist details;
• GMC, NMC or other appropriate professional registration for prescribers;
• CQC, HIS, HIW or RQIA registration and regulated-activity details, where applicable;
• ICO registration details;
• MHRA licences, registrations or authorisations relevant to the activity;
• Home Office controlled-drug licences, if required;
• evidence relating to Patient Group Directions or Pregnancy Prevention Programmes, where relevant;
• evidence for any pharmacy preparing specials or compounded products; and
• equivalent licences for every additional country served.

Do not submit an expired registration, a screenshot that omits the registrant's identity, or a licence belonging to a different legal entity without explaining the relationship.

3. Partners and connected businesses

Map every organisation that contributes to:

• patient acquisition;
• clinical consultation;
• prescribing;
• dispensing;
• medicines supply;
• fulfilment and delivery;
• payment collection;
• customer support;
• laboratory or diagnostic work; and
• marketing or affiliate referrals.

LegitScript uses the word affiliate for connected people or businesses with a commercial or professional relationship to the applicant. Its standards require applicants to disclose these connections and all domains under their control.

The UK checklist says partner pharmacies that are essential to delivering the service are generally expected to hold recognised certification. Where an uncertified pharmacy or medical provider partners with a successful applicant, the checklist says the partner may need to submit its own LegitScript application within 60 days. Confirm how this applies to the specific arrangement directly with LegitScript.

Prepare contracts or letters that explain:

• the service each partner performs;
• which party employs or contracts each clinician;
• who owns the patient relationship and records;
• who is accountable for prescribing and dispensing;
• what information is shared;
• how incidents, complaints, recalls and safeguarding concerns are handled; and
• how the arrangement is monitored and ended.

4. The clinical and pharmacy pathway

Document the complete patient journey from advertisement to follow-up. Include:

• how users are identified and age-checked;
• eligibility, exclusion and escalation criteria;
• the consultation method;
• how informed consent and capacity are addressed;
• how prescribers obtain sufficient information;
• how identity, symptoms, medical history, concurrent medicines, allergies and contraindications are checked;
• safeguards for higher-risk medicines or patient groups;
• when GP or other clinician information is sought or shared;
• how prescribing and dispensing decisions are kept appropriately independent;
• how a patient is refused treatment;
• clinical record keeping and access;
• monitoring and follow-up;
• adverse-event, safeguarding and incident processes;
• delivery, failed-delivery and cold-chain controls where relevant;
• complaints and refunds;
• product recall processes; and
• business continuity.

For pharmacies in Great Britain, the GPhC expects owners and superintendents to assess the risks of each service, medicine and medical device supplied at a distance, maintain accessible records and review risk controls as services change. Our pharmacy clinical governance guide explains how to turn those responsibilities into an owned review system. Use the current GPhC guidance for pharmacies providing services at a distance as a core readiness document. Northern Irish pharmacies should use the relevant PSNI standards and guidance and confirm the supporting evidence LegitScript expects.

5. Website disclosures and transparency

The LegitScript UK checklist says pharmacy homepages should display:

• the pharmacy's GPhC registration number;
• the registered pharmacy owner's name;
• the Superintendent Pharmacist's name, if applicable;
• the name, physical address, telephone number and email address of the registered pharmacy or pharmacies supplying medicines; and
• for telehealth services, the prescriber's name, address, contact details, registration number and country or countries of registration.

Because this wording is GPhC-focused, a Northern Irish pharmacy should ask LegitScript how it wants the corresponding PSNI registration displayed and evidenced.

Also check that the website clearly provides:

• the legal business identity and trading name;
• contact and complaints routes;
• the countries or territories served;
• privacy and cookie information;
• terms of service, cancellation and refund terms;
• accurate pricing and payment information;
• delivery limitations;
• practitioner and pharmacy roles;
• security across the whole patient pathway; and
• a working patient portal.

If part of the site is still being built, prepare wireframes, screenshots and a completion timetable. If the patient journey sits behind a login, create a test account for the reviewer. Use synthetic test information only; never provide a real patient's account.

Conduct a medicines-advertising audit before applying

LegitScript certification does not make prohibited advertising lawful. It also does not override an advertising platform's own decisions.

For UK public advertising:

• Prescription-only medicines and prescription-only treatments must not be advertised to the public.
• Ads should promote the consultation or service rather than a POM.
• A homepage, paid-ad landing page, social post or affiliate ad should not name or unmistakably imply a POM.
• Images of injection pens, references to drug classes, product-shaped imagery, hashtags, price promotions and other contextual cues can amount to POM advertising even when the brand name is omitted.
• Off-label promotion is prohibited.
• Claims about licensed medicines must remain within the marketing authorisation and approved product information.
• A factual price list on an appropriate inner page must not become a call to action, comparison or promotional claim.
• Affiliate and influencer content remains part of the compliance risk.

Use the current MHRA Blue Guide, MHRA medicines-advertising guidance, CAP Code section 12 and ASA advice on prescription-only medicines.

Audit more than the visible navigation. Check:

• paid-ad landing pages;
• unlinked product pages;
• page titles and meta descriptions;
• structured data;
• image filenames and alt text;
• pop-ups and banners;
• reviews and testimonials;
• emails and SMS;
• social profiles;
• affiliate pages and discount-code sites;
• downloadable price lists;
• abandoned test pages; and
• indexed staging domains.

Record every issue, correction, approver and completion date. Keep screenshots of the corrected pages.

How to complete the application

Step 1: confirm the certification category and domains

Decide whether the applicant is a pharmacy, remote prescribing or telemedicine provider, facilitator, digital-health platform or another healthcare merchant. Identify every main website address to certify and disclose all related domains, even where only selected domains will be certified.

Step 2: create the LegitScript account

Create an account through LegitScript's certification portal, select Healthcare Certification and complete enrolment using an authorised business contact.

Use a shared, monitored business email rather than an account that will disappear if one employee leaves.

Step 3: pay the application fee

Pay the published non-refundable application fee for each root domain. Do not pay until the business model and correct route have been confirmed.

Step 4: complete the questionnaire and templates

Answer in plain language. Describe what happens in practice rather than pasting policies without explanation.

The questionnaire may ask about:

• the business model;
• principals and officers;
• pharmacy facilitation;
• websites and related businesses;
• payments;
• pharmacies and practitioners;
• licences and jurisdictions;
• controlled drugs, specials or other higher-risk activities;
• disciplinary, legal or regulatory history;
• partners and affiliates;
• the patient journey;
• privacy and security;
• advertising; and
• recalls or complaints.

Use “not applicable” only with a short explanation. Do not force a UK model into a US-specific answer where the requirement genuinely does not apply.

Step 5: upload the evidence

Use clear filenames such as:

01-Companies-House-Certificate-Entity-Name.pdf

02-Pharmacy-Registration-GPhC-or-PSNI-1234567.pdf

03-Patient-Journey-v3-2026-10-20.pdf

Create an index linking every application answer to its supporting evidence. Remove real patient data from screenshots and demonstrations.

Step 6: perform a final consistency check

Before submission, compare:

• the application against the live website;
• registered names and addresses across all sources;
• every service against the licences supplied;
• all practitioner lists against current registers;
• every partner named in contracts against the affiliate disclosure;
• the geographic service area against website access and delivery rules; and
• advertising claims against the current live pages.

Test the patient journey on desktop and mobile, including refusals and error states.

Step 7: submit and monitor the application

LegitScript will screen the application and may assign an analyst. Keep one response log showing:

• the date of each request;
• the question asked;
• the owner;
• the response and evidence supplied;
• any website or process change;
• the date the live change was checked; and
• any outstanding dependency.

Respond promptly, but do not guess. If a question needs clinical, regulatory or legal review, say so and provide a realistic response date.

Step 8: complete remediation

LegitScript describes its review as collaborative and says missing information does not automatically result in denial. The analyst may ask for clearer documents, website changes or further explanation.

Treat remediation as controlled change:

1. Identify the underlying issue.
2. Decide whether it affects the website, policy, contract or operating process.
3. Obtain the right internal approval.
4. Implement the change.
5. Test the live result.
6. Send concise evidence showing what changed and where.

Avoid making a cosmetic website correction if the actual operational process remains inconsistent.

Step 9: pay the annual fee after approval

If approved, pay the annual certification fee to activate certification. Confirm the certified legal entity, root domain and public LegitScript status before using the certification seal.

Step 10: apply separately to advertising platforms

LegitScript approval does not automatically certify a Google Ads account or approve an ad. Complete the relevant platform's healthcare-certification process using the same legal entity, domain and service category.

Keep prescription-drug advertising restrictions in place after certification. Each campaign, keyword, creative and landing page remains subject to platform policy and UK advertising law.

Common causes of delay or refusal

Applications commonly become difficult where:

• the applicant cannot clearly explain who prescribes, dispenses or takes payment;
• company names, addresses or ownership differ across official records;
• a domain, affiliate, co-owned business or partner is omitted;
• the dispensing pharmacy or prescriber relationship is undocumented;
• the partner pharmacy is not prepared for its own certification obligations;
• the website is unfinished or the reviewer cannot access the portal;
• registrations are expired or cover the wrong entity or activity;
• the service accepts patients in jurisdictions not covered by the supplied licences;
• POMs are promoted on the homepage, ads, landing pages or social channels;
• unapproved or off-label medicines or claims appear on the website;
• clinical safeguards exist in policy but not in the live questionnaire;
• disciplinary history, litigation, warnings or recalls are incompletely disclosed;
• price, refund, subscription or delivery terms are unclear;
• real patient data is used in demonstration evidence; or
• analyst questions receive slow, partial or contradictory answers.

What to maintain after certification

LegitScript certification involves ongoing monitoring. Create a change-control trigger requiring the certification owner to review:

• a new root domain or trading name;
• a change of ownership, director or other person who controls the business;
• a new pharmacy, prescriber, wholesaler or fulfilment partner;
• a new service, medicine category or jurisdiction;
• a change to the consultation or prescribing pathway;
• a new payment processor;
• a regulatory inspection, warning, sanction, recall or material complaint;
• a major website redesign;
• new affiliate or influencer activity; and
• a change to platform advertising policy.

Run a quarterly website and advertising review and a formal annual evidence refresh. Track registration expiry dates well in advance.

A 30-day preparation plan

Week 1: scope

• Confirm whether LegitScript is required.
• Map the entities, domains, jurisdictions and patient journey.
• Identify every prescriber, dispensing pharmacy and material partner.
• Obtain a written eligibility clarification from LegitScript if needed.

Week 2: evidence

• Build the licence and registration pack.
• Gather contracts and partner confirmations.
• Document prescribing, dispensing, records, privacy, delivery and complaints.
• Create the application evidence register.

Week 3: website and advertising

• Add required homepage disclosures.
• Audit POM references, claims, prices and landing pages.
• Test privacy, security, terms, refunds and contact routes.
• Create a synthetic test patient account.

Week 4: challenge and submit

• Run a mock review with someone outside the project.
• Resolve contradictions between the website, policy and actual process.
• Complete the questionnaire and licence or registration templates.
• Secure owner, superintendent and clinical sign-off.
• Pay and submit only when the evidence is coherent.

Final application checklist

Before selecting “submit”, confirm:

• ☐ The correct certification category has been agreed.
• ☐ Every root domain and related domain has been disclosed.
• ☐ Legal entity, ownership and address details match official records.
• ☐ The relevant GPhC or PSNI, prescriber, service-regulator, ICO, MHRA and controlled-drug evidence is included where applicable.
• ☐ Every country served is listed and supported by appropriate authority.
• ☐ The patient journey names the organisation responsible at each stage.
• ☐ Contracts support every prescriber, dispensing and fulfilment relationship.
• ☐ Partner certification implications have been checked.
• ☐ The live homepage contains the required pharmacy and prescriber disclosures.
• ☐ Privacy, security, terms, refunds, complaints and delivery information are live.
• ☐ POM advertising and off-label claims have been audited across every channel.
• ☐ A synthetic portal login has been tested.
• ☐ Disciplinary, regulatory, litigation and recall history is fully disclosed.
• ☐ All evidence files are current, legible and indexed.
• ☐ The Superintendent Pharmacist and appropriate clinical lead have reviewed the submission.
• ☐ The team understands that LegitScript approval does not guarantee ad approval.

Frequently asked questions

Does every UK online pharmacy need LegitScript?

No. Requirements depend on the business model, target country, advertising platform and payment arrangements. Google currently identifies GPhC registration plus Google's own certification for UK online pharmacies, while UK remote prescribing or telemedicine services require LegitScript before Google's certification. Northern Irish pharmacies should seek specific confirmation because they are regulated by PSNI rather than GPhC. Other platforms or payment providers may apply different requirements.

Does certification allow a pharmacy to advertise prescription-only medicines?

No. Certification does not override UK medicines-advertising law, the CAP Code or platform rules. Public advertising should promote the consultation or service, not a POM.

How long does certification take?

LegitScript does not publish a standard completion time. Complexity, completeness, responsiveness and application volume all affect the duration. Expedited processing prioritises the start of review; it does not guarantee a decision within two days.

Is the application fee refundable?

LegitScript states that the application fee is non-refundable. The annual certification fee is charged only after approval.

Does each website need a separate application?

Multiple websites under common ownership can be included in one application, but fees are assessed for each root domain being certified. Subdomains are normally covered by their root domain.

Must a partner pharmacy also be certified?

LegitScript's standards say partners essential to delivering the patient service, including dispensing pharmacies, are generally expected to hold recognised certification, subject to limited exceptions. Its UK checklist describes a 60-day application expectation for certain uncertified pharmacy and medical-provider partners. Confirm the exact requirement for the proposed relationship with LegitScript.

What happens if LegitScript finds a problem?

LegitScript says the review can include requests for information and reasonable remediation. Correct the underlying process as well as the public page, document the change and provide clear evidence.

Who should own the certification?

An accountable business lead should coordinate it, with active input from the Superintendent Pharmacist, clinical lead, data-protection lead, website owner, payments team and relevant partners. It should not be treated as a marketing-only application.

Core official resources

• LegitScript Healthcare Certification
• LegitScript Healthcare Certification FAQ
• LegitScript UK application checklist
• LegitScript Healthcare Certification Standards
• LegitScript application questionnaire
• LegitScript general certification FAQ
• Google healthcare and medicines policy
• Google healthcare certification guidance
• GPhC distance-services guidance
• GPhC pharmacy-regulation role
• PSNI pharmacy information
• UK remote-prescribing regulator map
• MHRA Blue Guide
• MHRA guidance on advertising medicines
• CAP Code section 12
• ASA guidance on prescription-only medicines

Editorial note: Requirements, platform policies and fees can change. Recheck the linked primary sources immediately before an application or advertising launch.