The list
A DTC telehealth brand needs seven documents in place before launch, and each one belongs to a specific entity. The medical practice (usually a physician-owned professional corporation) issues the telehealth informed consent and, if it is a HIPAA covered entity, the Notice of Privacy Practices. The brand (usually the management company) issues the terms of service, the website privacy policy, the auto-renewal disclosures and the consumer health data policy. Pharmacy and medication terms sit between the two. The issuer matters as much as the wording.
This is not legal advice; have healthcare counsel in your launch states review every document before it goes live.
| Document | Issued by | Required by | Where the patient sees it |
|---|---|---|---|
| Telehealth informed consent | The practice (PC) | State law and medical board rules, which vary | In intake, before the provider reviews the case |
| Terms of service | The brand (MSO) | Contract law; FTC Act on deception | Linked at signup, accepted by checkbox |
| Website privacy policy | The brand | State privacy laws; FTC Act | Footer and signup |
| HIPAA Notice of Privacy Practices | The practice, if a covered entity | 45 CFR 164.520 | In intake or portal, with acknowledgment |
| Auto-renewal disclosures and consent | The brand (merchant of record) | ROSCA; California ARL and other state laws | Checkout, next to the price, plus confirmation email |
| Consumer health data privacy policy | The brand | Washington MHMDA; Nevada SB 370 | Linked from the homepage |
| Pharmacy and medication terms | Brand and practice, with pharmacy input | FDA rules on claims; state pharmacy rules | Product pages, checkout, terms |
Telehealth informed consent
The majority of states have some telehealth-specific consent requirement in statute, regulation or Medicaid policy, according to the Center for Connected Health Policy, which tracks them state by state. The form of consent varies, and a few examples show how much.
California's Business and Professions Code section 2290.5 requires the provider initiating telehealth to inform the patient about the use of telehealth and obtain verbal or written consent before delivering care, and the consent must be documented. Arizona's A.R.S. 36-3602 also accepts verbal or written consent (electronic since a 2021 amendment), with documentation in the record, while Arizona's psychology board requires written consent for telepractice. Some states attach stricter rules only to Medicaid; Georgia Medicaid, for example, requires written consent before a telemedicine visit.
For an async DTC program, the practical design is a written, electronic consent inside intake, captured before the case reaches a provider, stored in the chart with a timestamp and version number, and written to the strictest state you serve. It should cover the limits of telehealth (no physical exam, the provider may decline to treat), what to do in an emergency, and how prescriptions are filled. Version it, so you know who agreed to which text.
Terms of service and the website privacy policy
These are the brand's documents. The terms cover the relationship between the patient and the company that runs the storefront: what the subscription includes, what happens if the provider does not prescribe, refunds, disputes, governing law. They should say plainly that the brand does not practice medicine and that clinical services are provided by the named professional corporation. That one paragraph does a lot of work for the corporate practice structure explained in the MSO and friendly-PC model.
The privacy policy covers everything the website collects: analytics, cookies, email, ad attribution. The FTC's July 2026 complaint against Hims & Hers (filed with Utah and Los Angeles County; Hims denies the allegations) included health data shared with Meta and Snap through pixels and SDKs, and a privacy policy that does not match the tags on the page is the kind of gap that complaint describes. Our post on the case and first-party conversion tracking cover the tag side.
The HIPAA Notice of Privacy Practices, and when it does not apply
The Notice of Privacy Practices is a HIPAA covered entity's obligation under 45 CFR 164.520. A health care provider is a covered entity only if it transmits health information electronically in connection with a HIPAA standard transaction, such as claims, eligibility checks or remittance (the definition is in 45 CFR 160.103).
That produces three situations for a DTC brand:
- The practice bills insurance or runs electronic eligibility checks. It is a covered entity. It needs an NPP, given to patients at first service with a good-faith attempt at written acknowledgment. The brand, handling patient data on the practice's behalf, is a business associate and signs a BAA with the practice. So does the platform.
- The practice is strictly cash-pay and never conducts a standard transaction. It may not be a covered entity at all, and the federal NPP requirement may not apply. Many adopt an NPP anyway, since one insurance transaction later changes their status. Ask counsel; this is the most fact-specific question on the list.
- The brand itself. A management company that is not a provider and does not bill is not a covered entity in its own right. It gives no NPP. Its website privacy policy and state health data laws govern the data it collects before a patient becomes the practice's patient.
If HIPAA does not apply, the data is not unregulated. The FTC's Health Breach Notification Rule, amended effective July 29, 2024, covers health apps and similar services outside HIPAA and treats an unauthorized disclosure, not only a hack, as a breach. What HIPAA-compliant software actually means covers the vendor side.
Auto-renewal disclosures
Almost every DTC program is a subscription, so three layers apply.
ROSCA. The Restore Online Shoppers' Confidence Act applies to online sales with a negative option. Before taking billing information, the seller must clearly and conspicuously disclose the material terms, obtain the consumer's express informed consent before charging, and provide a simple way to stop recurring charges. The FTC's broader click-to-cancel rule was vacated by the Eighth Circuit on July 8, 2025 (Custom Communications v. FTC) days before it took effect; the FTC restarted the rulemaking with an advance notice in March 2026. ROSCA itself still applies, and it was one of the theories in the Hims complaint.
California's Automatic Renewal Law. Business and Professions Code sections 17600 and following, amended by AB 2863 effective July 1, 2025, require express affirmative consent to the renewal terms, retention of proof of that consent for at least three years or one year after the contract ends (whichever is longer), cancellation in the same medium the consumer used to sign up, and a yearly reminder for ongoing subscriptions (check with counsel how that applies to monthly plans). New York and Minnesota have their own versions; most brands write to California and apply it everywhere.
What that means for the checkout. The price, the billing interval, the fact that it renews, and how to cancel sit next to the buy button, not in the terms. Consent is a separate unchecked box. The confirmation email repeats the terms. Cancellation lives in the patient portal. And for telehealth specifically, we would charge only after a provider approves, which removes the most common refund dispute before it starts.
Consumer health data laws
Washington's My Health My Data Act took effect March 31, 2024 and reaches far beyond HIPAA. It covers consumer health data that companies collect from Washington consumers, including data that merely suggests a health condition, such as a weight-loss quiz answer. Information already protected as PHI under HIPAA is exempt, which is another reason to know which of your entities holds what. The core obligations:
- a separate consumer health data privacy policy, linked from the homepage
- consent to collect consumer health data, and a separate consent to share it, beyond what is necessary to provide the requested service
- a signed authorization before any sale of the data
- a ban on geofencing around health care facilities
It is enforced by the Washington Attorney General and through a private right of action under the state Consumer Protection Act. The first class action under it, Maxwell v. Amazon, was filed on February 10, 2025.
Nevada's SB 370 took effect the same day with similar rules, enforced by the attorney general only.
Pharmacy and medication terms
Patients want to know who fills their prescription; a 200-comment founder AMA on r/tirzepatidecompound in November 2025 asked brands to name the pharmacy before the order. Your terms and product pages should name the pharmacy or pharmacies, say whether a medication is FDA-approved or compounded (a compounded drug is not FDA-approved, and should never be described as a generic or equivalent of a branded one), state shipping and cold-chain handling, explain what happens on a backorder, and set out the return policy. Ask your pharmacy whether it accepts returns of dispensed medication and put its answer in the terms, so the refund policy and the pharmacy agree. The LegitScript reviewer reads these pages too; our LegitScript post lists what fails.
Where a platform helps
A platform cannot write your consent form, but it can put each document where it does its job. Turbopills puts the consent step inside conditional intake before provider review, stores the response with the chart, starts billing only after clinical approval, shows renewal terms at checkout and puts cancellation in the branded portal. Ask us in a demo to show where each of the seven documents appears in the patient flow, and which ones are yours to supply.
FAQ
Do telehealth providers need informed consent? In most states, yes, under telehealth-specific statutes, board rules or Medicaid policy. California, for example, requires verbal or written consent before telehealth care, documented in the record.
Does a cash-only telehealth practice need a HIPAA Notice of Privacy Practices? Only if it is a covered entity, which depends on whether it conducts HIPAA standard transactions electronically, such as insurance claims or eligibility checks. Many cash-pay practices provide one anyway; ask counsel.
Does Washington's My Health My Data Act apply to telehealth brands? It applies to companies collecting consumer health data from Washington consumers that is not already PHI under HIPAA. A brand's intake quiz and site analytics can fall inside it.
Is the FTC click-to-cancel rule in effect? No. The Eighth Circuit vacated it in July 2025, and the FTC reopened rulemaking in March 2026. ROSCA and state auto-renewal laws such as California's still require clear disclosure, express consent and an easy way to cancel.