GLP-1 telehealth stack guide: 7 layers you need in 2026

The guide you read last year is out of date. The FDA resolved the semaglutide shortage in February 2025 and in September began sending warning letters to telehealth companies over their marketing of compounded GLP-1s. Truepill received a DEA Order to Show Cause in December 2022 over controlled-substance prescribing; the case was settled in November 2023 with heightened compliance measures, and the company was acquired in late 2024. In February 2026 Novo Nordisk sued Hims & Hers over its compounded semaglutide, then dropped the suit in March after Hims & Hers agreed to stop advertising compounded GLP-1s. Operators who had built a whole program around one compounding pharmacy or one fulfillment partner learned, at real cost, what infrastructure resilience means.

Demand hasn't gone anywhere. Eli Lilly alone reported $36.5 billion in 2025 revenue from Mounjaro and Zepbound, and patients are still looking for care. What changed is the stack you need to serve them without regulatory and operational land mines, and it looks different from what worked in 2023.

The seven layers of a GLP-1 stack

Every GLP-1 program, whatever its size, has to solve seven problems. Some teams cover several layers with one platform and others assemble separate tools. Either way, each of the seven needs real coverage, because a gap at any layer costs you revenue, patients, or your ability to operate legally.

1. Marketing site: how patients find you and decide you're legitimate
2. Checkout and intake: how patients pay, enroll, and submit health information
3. Provider network: who evaluates patients and writes the prescriptions
4. Pharmacy and eRx: how prescriptions get filled and shipped compliantly
5. Patient portal: where patients track treatment, see their titration schedule, and manage refills
6. CRM and data routing: how patient data moves between systems without getting lost
7. Analytics: how you measure conversion, churn and cohort retention before problems become crises

1. Marketing site

What does a GLP-1 marketing site do?

Your marketing site is where organic search converts, where paid traffic lands, and where patients decide whether your program is legitimate. Trust signals carry more weight in GLP-1 than in almost any other vertical. Someone thinking about a weekly injection prescribed after a 10-minute async consultation does a lot of checking before they pay. If your site doesn't hold up, they go to a competitor.

What makes a GLP-1 marketing site convert in 2026?

Speed, LegitScript certification, and structured trust signals. Start with speed. A site that scores below 80 on Lighthouse mobile loses a measurable share of conversions, and operators who move from low to high Lighthouse scores see more checkout starts from the same paid traffic. Your cost per acquisition drops without any change to the ad budget.

Then LegitScript. Google requires LegitScript certification to run ads for telehealth programs and prescription drug services, so a GLP-1 program that wants Google Ads or Meta Ads has to have it. Without it, your ads get disapproved or your account gets suspended. Build the site to meet LegitScript's certification requirements from day one so you never have to retrofit it.

Common GLP-1 marketing site mistakes

Using a bloated page builder that loads 2MB of JavaScript before the patient sees anything. Skipping the structured data markup behind your appearance in "GLP-1 near me" and "semaglutide online" results. Treating the site as a brochure when it should be a conversion funnel with measurable steps. And building without LegitScript in mind, which means you launch, apply for certification, get denied for something structural, and spend three weeks rebuilding what could have been right from the start.

Custom work pays for itself quickly at this layer. A site built for performance (90+ Lighthouse scores, fast LCP, clean structured data) converts better than a template, and the difference shows up in tracked checkout conversion. thimblesites builds brand sites for telehealth brands to LegitScript's requirements and links them to your checkout and patient portal. The certification itself stays yours.

2. Checkout and intake

What does GLP-1 checkout and intake do?

Checkout and intake is where a patient goes from interested to enrolled. They pick a program, pay, and complete the medical questionnaire. No other piece of the stack moves revenue as directly. A 5% improvement in checkout completion is worth more than almost any other optimization you can run, because it applies to every patient you acquire from then on.

What makes GLP-1 checkout and intake work?

Offer flexibility and wallet support. GLP-1 programs are complicated commercial products. You need subscriptions on different billing cycles, tiered dosing plans whose price changes as patients titrate up, membership models, add-ons for lab work or supplies, and upsells for adjacent services. Checkout has to handle all of it without duct tape.

FSA and HSA payment support now makes a real difference to revenue. A significant share of GLP-1 patients pay through FSA or HSA accounts, particularly employer-covered patients who recently had GLP-1 coverage added to their benefits. If your checkout can't take FSA/HSA cards (which takes specific merchant category codes and sometimes dual processing), you turn away patients who have the budget and the motivation. Apple Pay and Google Pay express checkout consistently convert better on mobile too. In 2026 patients expect both.

For intake forms, Formsort is built for healthcare, with conditional logic and HIPAA compliance. Typeform works for simpler flows. Cognito Forms handles complex conditional logic at a lower price and is underrated by teams on tight budgets.

thimblecart runs checkout and intake as one flow on your brand: an availability check, intake, plans, promo codes, and payment, and Scale adds upsells at Pay. Each order lands in your patient and admin portals and goes on to the clinician network you choose, and prescriptions go to the pharmacy you pick: your network's, your own, or another.

3. Provider network

What does a GLP-1 provider network do?

The provider network evaluates patients and writes prescriptions. Unless you're a medical group with your own clinicians, you contract a network that supplies licensed prescribers in the states where your patients live. Buy this layer. Building your own provider network is a regulatory and operational undertaking that almost no early-stage GLP-1 operator should attempt.

How to choose a GLP-1 provider network in 2026

Compare state coverage, turnaround time, clinical quality, and integration. The major networks have different strengths. OpenLoop says it covers all 50 states and serves 900,000+ patients a month (openloophealth.com, checked Oct 10, 2026). Wheel also offers broad state coverage for high-volume programs. MD Integrations (MDI) works well for teams that want more control over the clinical relationship. SteadyMD fits dedicated-provider models where the same clinician sees your patients over time. No network yet? thimblehub matches you with one that fits and sets it up, and your agreement is with the network directly.

GLP-1 medications (semaglutide, tirzepatide) are not controlled substances, so the Ryan Haight Act's in-person examination requirement doesn't apply to them. Many GLP-1 programs also offer adjacent services that do involve controlled substances (ADHD, anxiety, sleep). If you offer those, the DEA telehealth flexibilities extended through December 31, 2026, apply to them. Track the DEA rules for every service you offer, including the ones outside GLP-1.

Common provider network mistakes

Choosing a network on per-consult cost without checking turnaround time. A network that charges $5 less per consult but takes 48 hours instead of 8 will cost you far more in patient drop-off and support tickets than you'll ever save. Patients who pay $300 and then hear nothing for three days dispute the charge. We've watched this drag down conversion in programs that were otherwise well built.

The other mistake is running paid acquisition before confirming state coverage. If you're buying traffic in Florida and your network isn't credentialed in Florida, every patient you acquire there is one you can't serve. Confirm coverage state by state before you turn on ads anywhere.

4. Pharmacy and eRx

How does GLP-1 pharmacy fulfillment work in 2026?

The 2025 crackdown hit this layer hardest, and it is where the stacks that survived differ most from the ones that didn't. The FDA resolved the semaglutide shortage in February 2025. FDA's grace period for 503A pharmacies ended in late April 2025, after a court ruling on April 24, and 503B outsourcing facilities had until May 22, 2025. Programs built around compounded semaglutide as their core product had to rebuild this layer fast.

Separately, Truepill's DEA compliance issues (an Order to Show Cause in December 2022, settled in November 2023 with heightened oversight requirements, then an acquisition in late 2024) forced programs relying on Truepill for controlled-substance fulfillment to find alternatives under pressure. Truepill was one case of a broader risk. A single pharmacy dependency is a single point of failure, and this market has shown that it will test those failure points.

What makes GLP-1 pharmacy fulfillment reliable?

For eRx routing, DoseSpot and DrFirst are the two dominant platforms, and most provider networks already integrate with one or both. For fulfillment, choose a mail-order or specialty pharmacy that ships to every state you serve and sends tracking updates your patient portal can show. Specialty and mail-order pharmacies that carry brand-name Wegovy and Zepbound through proper channels are now the compliant path for GLP-1 programs. Programs still operating in the compounded space need documented medical necessity for each patient (a general business model doesn't qualify), and they need relationships with PCCA-member 503A pharmacies that run strong compliance programs.

Pharmacy diversification is not optional

Set up at least two pharmacy partners from day one. You may never need both at once. If you rely on one partner and it turns out to be unstable, the cost is weeks of patient disruption and possible chargebacks. The programs that came through the 2025 crackdown with the least damage had already built a fallback: a primary mail-order pharmacy, a second pharmacy for overflow, and documented processes for switching between them.

5. Patient portal

What does a GLP-1 patient portal do?

The patient portal is the experience after enrollment. Patients check order status, message support, request refills, and manage their account there. For a subscription program, retention happens in the portal, and it is also where the gap between what a patient expected and what they got is easiest to see.

What GLP-1 portals need that generic portals don't have

Dosage and titration tracking. GLP-1 patients follow a titration schedule that usually starts low (0.25mg weekly for semaglutide) and steps up over months. They need to see where they are in that schedule, when they move up, and what dose they're on now. Patients need that clinical context to understand their own treatment, and neither a standard order status display nor a generic EHR patient portal presents it in a patient-friendly way.

The portal also needs clear status at every stage: intake submitted, provider review, prescription sent, pharmacy fulfillment, shipped, delivered. The top driver of support tickets in GLP-1 programs is "where is my medication?" A portal that answers it before the patient has to ask removes a large share of support volume.

For the EHR layer, Healthie is excellent for telehealth-native workflows and has a modern API. Elation Health and athenahealth are stronger if your clinical team prefers a traditional interface. Canvas Medical is the developer-friendly, API-first option for teams that want maximum control over the patient data model.

thimbleportal runs the patient and admin portals. Patients log doses, answer refill check-ins, message their care team, follow their shipments, and can pause instead of canceling. Your team reviews refills, answers messages, and manages products and prices in the admin portal, and clinical decisions stay with your clinician network.

Common patient portal mistakes

Treating the portal as an afterthought and sending patients to a generic EHR portal that was never designed for DTC. Your checkout was branded and polished. If the portal looks like a 2012 medical records system, the contrast alone creates distrust and churn, and cancellations pile up in the gap between the two.

6. CRM and data routing

What does CRM and data routing do in telehealth?

The CRM layer is the connective tissue of your stack. Patient data lives there, automations trigger from it, and your operations team runs the day-to-day in it. Most stacks fall apart at this layer, and the failure stays out of sight until it becomes a patient crisis.

What makes telehealth data routing work?

Clean, monitored data flow between every system. When a patient completes checkout, their information has to reach your CRM, trigger a provider assignment, notify the clinical team, and send the prescription to the pharmacy. When the pharmacy ships, tracking status has to flow back to the patient portal. Every gap in that chain becomes either a manual task for your team or an unexplained silence for your patient, and that silence turns into disputes.

Refill management has to be automated once you grow. A 200-patient program can handle refill outreach by hand. At 500 patients, you can't. You need automated sequences for refill reminders, payment failure recovery, and renewal consultation scheduling. Recovering failed payments automatically within the first 48 hours of a failed charge wins back a meaningful share of revenue you would otherwise lose.

For the CRM itself, Tellescope is built for telehealth and handles patient communication, task management, and care coordination well. HubSpot and Salesforce are the enterprise options. GoHighLevel is popular with smaller operators who want marketing and CRM in one platform, though it needs customization for healthcare workflows.

Automation platforms tie everything together, but HIPAA narrows the field sharply for any workflow that touches PHI. Zapier and Make have broad integration libraries but do not offer HIPAA-compliant plans and cannot sign BAAs, so keep them to non-PHI workflows such as Slack notifications, marketing automation, or operational alerts. For PHI-touching automations, the realistic options are Keragon (healthcare-specific, BAA-eligible), self-hosted n8n inside an environment you control, or direct API integrations.

Common data routing mistakes

Building automations that fail silently. A Zapier workflow that errors at 2 AM leaves a patient unassigned to a provider, which means a 24-hour delay nobody told them about, which means a support ticket or a dispute. Give every automation alerts, retry logic, and fallback handling, and treat it as production infrastructure, because that's what it is.

7. Analytics and lab integration

What do analytics and labs cover in a GLP-1 program?

Analytics in a GLP-1 program covers business metrics (conversion, churn, LTV, cohort retention) and clinical data (lab results, dosing outcomes, patient-reported progress). Programs that require lab work also need lab integrations, and lab work is increasingly standard as programs mature and payers push for outcomes documentation.

What metrics matter most for GLP-1 programs in 2026?

On the lab side, Health Gorilla is the leading aggregator for electronic lab ordering and results retrieval, connecting to both Labcorp and Quest Diagnostics. If your program requires baseline metabolic panels or A1C testing before prescribing, you need a clean integration here. Some provider networks handle lab ordering themselves, and others expect you to manage it.

On the business side, four metrics decide whether a program is healthy.

• Checkout conversion, from checkout start to payment complete. For warm traffic, the room between good and poor telehealth programs is wide.
• Time from payment to medication delivered. Well-run programs shipping brand-name GLP-1 by mail can get it under a week.
• 90-day refill rate by cohort. A low rate points to a retention problem inside your program, which is something you can fix.
• Support tickets per active patient per month. A high rate usually means your portal or status tracking has gaps.

Churn prediction matters more as GLP-1 programs grow. The patients most likely to cancel before month three share a behavioral signature: they don't log into the portal, they skip the follow-up assessment, and they're slower to request refills. Spot them at week four instead of week ten and you have time for a check-in sequence that keeps a meaningful share of them. That takes cohort-level analytics, since aggregate metrics hide it.

How the layers connect

Understanding each layer on its own is the easy part. Most teams underestimate how the layers connect. In the core data flow, a patient lands on your marketing site, clicks through to checkout, selects a plan, pays, and completes medical intake. Intake goes to the CRM and triggers provider assignment. The provider reviews intake and writes a prescription, which goes by eRx to the pharmacy. The pharmacy fills and ships, and shipping status flows back through the CRM to the patient portal, where the patient sees it in real time.

Every arrow in that chain can fail, and when one does, the patient sees silence. No update, no medication, no message. That's when they dispute the charge and file a complaint.

thimblehub is fully managed: we set up the site, checkout, and portals, connect them to the clinician network and pharmacy you choose, or a network we match you with, and keep the handoffs between them running.

Build vs. buy: a layer-by-layer decision

Each layer deserves its own build-or-buy call.

• Marketing site: build custom. It's your brand and your main conversion surface. A fast site built for LegitScript certification and 90+ Lighthouse scores will outperform a template, and the investment pays back in lower acquisition costs for the life of the program.
• Checkout and intake: buy or partner, and insist on customization. Checkout has to feel like your brand, handle your offer structure, support FSA/HSA, and connect to your provider and pharmacy partners. Generic off-the-shelf checkout won't cover all of that.
• Provider network: buy. Running your own network is a regulatory and operational burden that almost no program should take on before product-market fit. Use an established network.
• Pharmacy and eRx: buy, and keep at least one redundant relationship. Compliance and logistics make this a partnership decision with nothing to build in-house. Have a primary and a fallback.
• Patient portal: build custom or use a purpose-built tool. It's a retention surface and needs to feel like your brand. Include GLP-1 features such as titration schedule display. Generic EHR patient portals weren't designed for DTC, and it shows.
• CRM and data routing: buy the CRM and put your investment into routing. The quality of your automations and integrations matters more than which CRM you pick. Choose one your ops team can work in, then build reliable, monitored data flows with refill automation from day one.
• Analytics and labs: buy. Use Health Gorilla or direct lab integrations for clinical data. For business analytics, instrument your stack with events and build cohort dashboards. Add churn prediction as soon as you have 90 days of patient data.

Room to change in a volatile market

The GLP-1 market has shown, specifically and more than once, that pharmacy partnerships change, provider networks update their APIs, and regulations shift faster than most operators expect. The programs that came through 2025 in the best shape could adapt without rebuilding from scratch.

Separate layers give you that room. If your pharmacy partner has supply issues, you move to your fallback without touching checkout or the patient portal. If a new provider network offers faster turnaround, you onboard it without rewriting your intake flow. If regulation changes what you can offer, you update your checkout offers and leave the rest of the site alone.

Pick the right tool for each layer, make sure the tools talk to each other reliably, and keep a documented fallback at every layer that matters.

thimblehub follows that approach and runs it for you. When you change a pharmacy or a network, we set up the change, and your checkout and patient portal stay as they are.

Build for the version of a GLP-1 program you will actually run. In that version pharmacy supply chains get disrupted, FDA enforcement actions arrive with 90-day compliance deadlines, and patients expect Amazon-level tracking on a $350 monthly subscription.

Where to start

If you're launching a GLP-1 program today, start with the three layers patients touch directly: your marketing site, your checkout and intake flow, and your patient portal. Get those right first. They set your conversion rate, the first impression you make, and your retention, and those decide whether the program scales or stalls.

Then build out the provider network relationship, pharmacy integration (with a fallback), and CRM routing. These operational layers determine how reliably you deliver what you sold. Patients see less of them, but they keep the program running through supply disruptions and regulatory changes.

The stack you launch with doesn't have to be the stack you run forever. The architecture decisions you make now (modular or monolithic, custom or template, one pharmacy or several) are much harder to change under pressure. With the architecture right, individual tools can change as your program grows and the market keeps moving.