Between choosing a plan and receiving a vial, a buyer agrees to something on the order of four separate documents, usually through one checkbox. They are not interchangeable and they are not enforced by the same authority. One governs whether a prescription may lawfully be written, one governs the money, one governs what happens if anything goes wrong, and one governs the data. The last two are the ones that decide the outcome of a dispute, and they are the two a buyer is least likely to have read. What counts as a lawful evaluation in the first place is a separate question, handled in the state rules article.
The consent to treat
This is the clinical document: an acknowledgment that care will be delivered remotely, that the person on the other end is acting as a clinician, and that certain limits follow from the format. It is governed by state professional law rather than by any federal telehealth statute, which is why its content differs from state to state and why a seller’s intake can be built one way in one jurisdiction and another way elsewhere.
Two things are worth checking inside it, and neither is legal. Does it name the clinician, or a group? And does it state what happens between appointments — who answers a message about a side effect, how a dose change is authorized, whether there is a route to a person rather than a queue. A consent form describes the relationship being entered into, so a form that describes almost no relationship is itself information.
The terms of service, and the clause inside it
The terms of service is a commercial contract, and the provision that matters most in it is usually the dispute-resolution clause. Federal law gives such clauses unusual force. Section 2 of the Federal Arbitration Act provides that a written arbitration provision in a contract evidencing a transaction involving commerce “shall be valid, irrevocable, and enforceable, save upon such grounds as exist at law or in equity for the revocation of any contract or as otherwise provided in chapter 4.”[1]
That closing reference is the single federal carve-out, and it is narrow. Chapter 4 provides that, at the election of the person alleging it, no predispute arbitration agreement or predispute joint-action waiver is valid or enforceable with respect to a case relating to a sexual assault dispute or sexual harassment dispute, and that whether the chapter applies is for a court rather than an arbitrator to decide.[2] Nothing in that chapter concerns a medication, a billing dispute or an injury.
An arbitration clause also rarely travels alone. The most detailed public measurement of what these clauses contain is the Consumer Financial Protection Bureau’s March 2015 study — of consumer financial products, not health care, which is the limit to hold onto. In those six markets, 85% to 100% of contracts carrying an arbitration clause also carried a provision that arbitration may not proceed on a class basis, and most of those paired it with an anti-severability provision stating that if the no-class term fell, the whole arbitration clause should fall with it.[3] The same report’s survey of 1,007 credit card holders found consumers generally unaware of whether their contracts contained such a clause, with most of those who were bound wrongly believing they could still join a class action.[3]
The billing authorization, and the rule that is not there
A recurring charge needs consent, and the federal source of that requirement is a statute rather than a regulation. The Restore Online Shoppers’ Confidence Act makes it unlawful to charge a consumer for anything sold online through a negative option feature unless the seller does three things: provides text that “clearly and conspicuously discloses all material terms of the transaction before obtaining the consumer’s billing information”; obtains “express informed consent before charging” the account; and provides “simple mechanisms for a consumer to stop recurring charges.”[4]
The regulation many readers have heard of is no longer in force. In July 2025 the Eighth Circuit, consolidating petitions from four circuits, held that the Commission’s failure to issue a preliminary regulatory analysis was fatal and concluded: “Accordingly, we grant the petitions for review and vacate the Rule.”[5] The Commission then published a final rule effective February 12, 2026 restoring the Negative Option Rule “in the form it existed before the 2024 Rule became effective,” with its name reverting to “Use of Prenotification Negative Option Plans.”[6]
What that restored rule covers is worth seeing. Its operative text concerns “the sale, offering for sale, or distribution of goods and merchandise,” and its duties are about disclosing that a subscriber must notify the seller if he does not wish to purchase the selection, about whether billing includes postage and handling, and about the subscriber being given “at least ten (10) days in which to mail any form” accompanying an announcement.[7] It is a mail-order rule from 1973. A monthly telehealth subscription is not the thing it describes. So the live federal consent duty for a recurring GLP-1 charge is the statute, not the rule — and what the exit terms themselves say is the subject of the cancellation article.
The data documents, where one rule runs the other way
Health privacy at a telehealth service is two regimes with a seam between them. Where the entity is a HIPAA covered entity, the general rule is that it “may not use or disclose protected health information without an authorization that is valid under this section” except as the rule otherwise permits, and a separate authorization is specifically required for any use or disclosure for marketing and for any disclosure that is a sale of protected health information.[8]
Then comes the provision that points against the reader’s intuition. A covered entity “may not condition the provision to an individual of treatment, payment, enrollment in the health plan, or eligibility for benefits on the provision of an authorization,” outside a short list of exceptions concerning research-related treatment, enrollment underwriting and disclosures to a third party.[8] The consent a buyer most fears being strong-armed into — hand over the data or get no care — is the one federal law says cannot be made a condition of care. And an authorization must state “the individual’s right to revoke the authorization in writing” together with how to do it.[8]
The seam is that not everything is inside. The Federal Trade Commission’s Health Breach Notification Rule applies to vendors of personal health records, related entities and their service providers, and states that it “does not apply to HIPAA-covered entities, or to any other entity to the extent that it engages in activities as a business associate of a HIPAA-covered entity.”[9] The two regimes are drawn to fit together, which means a single brand can have a clinical layer inside HIPAA and a consumer-app layer outside it, with the privacy policy rather than the authorization governing the second. A qualitative study of the commercial virtual care industry found firms valuing patient data highly, using data collected at registration to market other products and services, and in some cases funded by pharmaceutical companies to analyze interactions and adjust care pathways with the goal of increasing uptake of a drug.[10]
Whether anyone can read these at all
The evidence is not encouraging, and it comes from adjacent digital health markets rather than from GLP-1 telehealth specifically. A mixed-methods analysis of 139 user agreements from digital mental health platforms found that they required approximately 16 years of education to comprehend, and that only 1.67% of services implemented any comprehension verification for informed consent.[11] A separate study of depression app privacy policies measured a mean reading grade of 13.1 (SD 2.44) against the FDA’s recommended grade of 8; only three apps in the sample met that recommendation, and 99% contained jargon that service users had themselves identified as opaque.[12]
The finding inside that second study is the one that reverses. Privacy policies produced to satisfy the European data protection regulation — a law written to strengthen consent — “weren’t more readable and were longer.”[12] A disclosure mandate reliably produces disclosure. It does not reliably produce understanding, and the two are measured differently.
What this site’s own write-ups record, and what they do not
Across all 286 seller write-ups published here, counting any mention anywhere in the prose, the following appear zero times: arbitration in any form of the word, a class-action or jury-trial waiver, a governing-law or venue clause, a privacy policy, and the phrase informed consent. HIPAA appears in 1. A terms-of-service or terms-and-conditions document is mentioned in 6, and some form of the word consent in 7.
Those zeros need their controls, because an absence with no control is an argument about the instrument rather than about the market. The same corpus, scanned the same way, records a cancel-at-any-time term in 28 write-ups, an auto-renewal or automatic-rebilling term in 12, and a non-refundable or no-refund clause in 11. Contract language is captured when a seller puts it where the write-up looks.
And that is the limit these counts carry. A write-up describes what a seller publishes on the surfaces a buyer meets before paying — product pages, pricing, FAQs — not a reading of 286 terms-of-service documents. So a zero measures surfacing, not existence, and given how the Arbitration Act treats these clauses the safer inference runs the other way: the clause is probably there, and it is simply never near the price. Treat every figure here as a floor. What each write-up does record is on the seller pages, against the criteria in the methodology.
How to read one before you pay
Six questions, all answerable in a few minutes, none of them requiring a lawyer. Where is the dispute-resolution clause, and does it name arbitration, a class-action waiver, or a specific state’s courts? Does the billing section state the standing charge, the renewal date and the cancellation route in text you saw before entering a card, as the statute requires? Is there an opt-out window for arbitration, and how long is it? Is the entity holding your data described as a covered entity, and is there a separate privacy policy for the app or the website? Are you being asked to authorize marketing or a data sale alongside treatment? And does the clinical consent name who is responsible for follow-up?
One more piece of context belongs on any page like this. Compounded drugs are not FDA-approved and are not reviewed by the FDA for safety, efficacy or quality before they are dispensed, so the paperwork is carrying more weight here than it would for an approved product bought at a counter: it is where the obligations of both sides are actually written down. A service that will not show the terms until after payment has told you something, and it is one of the tells collected in the red-flag article.
What could not be established
No systematic study of arbitration clauses, opt-out windows or data-use terms in United States GLP-1 telehealth contracts was located, which is why the readability figures above are drawn from adjacent markets and labeled as such, and why the roster counts are reported as floors. The prevalence figures from the Arbitration Study describe consumer financial products and are not evidence about health care contracts. No state’s telehealth consent statute is quoted or characterized above. Nothing on this page is legal advice, and whether any particular clause binds any particular person is a question for a licensed professional in that state.