Email Flows for Online Pharmacies
The email flows an online pharmacy needs, which email tools accept pharmacies, what HIPAA says about refill reminders, and what to keep out.
Article summary
TL;DR
An online pharmacy's email starts with order, prescription, shipping and refill messages, sent automatically from a tool that accepts pharmacies; Klaviyo's policy, for one, excludes prescription medication services. Keep health details out of subject lines. Refill reminders for a current prescription are not HIPAA "marketing"; manufacturer-paid offers are, and need written authorization.
- Klaviyo's Acceptable Use Policy (April 9, 2026) says you may not use its services for "Prescription medications, pharmaceutical products or services, medical therapies, telehealth".
- Mailchimp may not allow businesses that offer "Pharmaceutical products" (policy updated September 26, 2025).
- HIPAA excludes refill reminders for a drug currently prescribed from "marketing", as long as any third-party payment is reasonably related to the cost of sending them.
- Marketing emails need a physical address and an opt-out honored within 10 business days under CAN-SPAM.
- In health and beauty, automated flows reach a 1.65% placed order rate against 1.02% for campaigns (Klaviyo, 2026).
ChatGPT
Claude
Perplexity
GrokOn this page
This guide is part of our playbook on the best ecommerce platform for online pharmacies. The general guide, for any store: triggered email campaigns. SMS flows are in SMS flows for online pharmacies.
Check your email tool first
Before you design a single flow, check that your email platform accepts a pharmacy, and what it says about health data.
| Tool | What its policy says | What it means for you |
|---|---|---|
| Klaviyo | "You may not use the Services to offer products or services related to" prescription medications, pharmaceutical products or services, telehealth1Klaviyo, Acceptable Use Policy, updated April 9, 2026 | Not an option for prescription sales under its current policy |
| Klaviyo | Bars "medical records or health information, including Protected Health Information" in the platform1Klaviyo, Acceptable Use Policy, updated April 9, 2026 | NoPrescription or intake data in profiles or events |
| Mailchimp | May not allow businesses that offer "Pharmaceutical products"2Mailchimp, Acceptable Use Policy, updated September 26, 2025 | Ask before you build on it |
| Any tool | Check its acceptable use policy and whether it signs a business associate agreement | Needed if your emails carry protected health information |
Fig. 1Check the tool before the flows
KlaviyoNot an option for prescription sales under its current policy- MailchimpMay not allow “Pharmaceutical products”: ask before you build on it
- Any toolCheck its acceptable use policy and whether it signs a business associate agreement
- Emails with protected health informationOnly with a tool that signs a business associate agreement
Read the acceptable use policy before importing a single contact.
Watch out
Building flows on a tool whose policy excludes your business is how pharmacies lose their customer list overnight. Read the acceptable use policy before importing a single contact.
The email flows an online pharmacy needs
Most pharmacy emails are service messages. They come first, and they carry the most sensitive moments of the order.
| Flow | Trigger | Content | Type |
|---|---|---|---|
| Order received | Checkout | Order number, amount held, next step | Transactional |
| Prescription status | Pharmacist review | "Approved, preparing your order" or "We need more information" | Transactional |
| Shipped | Label created | Tracking link, delivery date | Transactional |
| Refill due | A few days before the next refill | Ship date, amount, link to skip or change | Refill reminder345 CFR § 164.501, definition of "marketing", HIPAA Privacy Rule, read November 2, 2026 |
| Renewal needed | Last authorized refill shipped | How to request a new prescription | Refill reminder345 CFR § 164.501, definition of "marketing", HIPAA Privacy Rule, read November 2, 2026 |
| Payment failed | Declined renewal | Private card update link | Transactional |
| Store news and offers | Campaign | Non-prescription products, shipping offers | Marketing: consent, CAN-SPAM5FTC, CAN-SPAM Act: A compliance guide for business, read October 26, 2026 |
Fig. 2The service emails, as the patient sees them
What each email does
- Order received: says the hold is not clinical approval.
- Prescription status: approved, or "We need more information".
- Shipped: tracking link and delivery date.
- Refill due: a refill reminder, a few days before the next refill.
- Your pharmacyCheckoutOrder receivedOrder number, amount held, next step.
- Your pharmacyReviewPrescription statusApproved, preparing your order.
- Your pharmacyLabel createdShippedTracking link and delivery date.
- Your pharmacyBefore refillRefill dueShip date, amount, link to skip or change.
Order, review, shipping, refill: no medication name anywhere.
The order-received email should be precise about the payment. Tagada's Rx documentation says the hold at checkout "is not clinical approval" and the storefront copy "must make that clear"7Tagada docs, Tagada Rx introduction, read November 2, 2026. Repeat it in the email. If you are launching a prescription brand rather than a pharmacy, Tagada Rx runs storefront, doctors, pharmacy and payments in one stack.
Failed payments: failed payment recovery for online pharmacies. Refill billing: subscription billing for online pharmacies.
What can go in a pharmacy email
Emails are read on lock screens, shared inboxes and work devices. Write them so a stranger learns nothing about the customer's health.
Keep in the email
- Order number, amount, ship date, tracking link.
- The pharmacy name the customer knows.
- A secure link to the account for details.
Keep out of the email
- Medication names, in the subject, preview text or body.
- The condition or the reason for the prescription.
- Intake answers or prescription images.
- Health data in the tags and events you send to your email or ad tools.
Refill reminders and HIPAA
If your pharmacy is a HIPAA covered entity, the Privacy Rule decides which emails count as "marketing". Marketing that uses patient information needs the patient's written authorization445 CFR § 164.508(a)(3), authorization required for marketing, read November 2, 2026.
| Marketing under HIPAA? | |
|---|---|
| Refill reminder for a drug currently prescribed | NoIf any third-party payment is reasonably related to the cost of sending it345 CFR § 164.501, definition of "marketing", HIPAA Privacy Rule, read November 2, 2026 |
| Information about a health-related product or service your pharmacy provides | NoUnless a third party pays you to send it345 CFR § 164.501, definition of "marketing", HIPAA Privacy Rule, read November 2, 2026 |
| Email paid for by a manufacturer whose product it describes | YesAuthorization required, stating the payment345 CFR § 164.501, definition of "marketing", HIPAA Privacy Rule, read November 2, 2026445 CFR § 164.508(a)(3), authorization required for marketing, read November 2, 2026 |
| Promotional gift of nominal value | Exempt from the authorization requirement445 CFR § 164.508(a)(3), authorization required for marketing, read November 2, 2026 |
Fig. 3Which pharmacy emails count as marketing
- Refill reminder for a drug currently prescribedNo, if any third-party payment is reasonably related to the cost of sending itNot marketing
- A health-related product or service your pharmacy providesNo, unless a third party pays you to send itNot marketing
- Email paid for by a manufacturer whose product it describesYes: authorization required, stating the paymentMarketing, authorization
- Promotional gift of nominal valueExempt from the authorization requirementExempt
Green: not marketing. Red: authorization needed. Amber: exempt.
CAN-SPAM applies on top for commercial emails: accurate sender, honest subject line, a physical postal address, and an opt-out honored within 10 business days5FTC, CAN-SPAM Act: A compliance guide for business, read October 26, 2026. Ask counsel to review your program; state privacy laws can add requirements.
Measure your flows
| Metric | Formula | Watch for |
|---|---|---|
| Refill reminder conversion | Refills confirmed ÷ reminders sent | Low: reminder too late or link broken |
| Renewal requests | Renewal requests ÷ "renewal needed" emails | Customers lost at the end of a prescription |
| Placed order rate, flows vs. campaigns | Orders ÷ recipients | Klaviyo health and beauty reference: 1.65% vs. 1.02%6Klaviyo, Email and SMS benchmarks 2026 (health and beauty) |
| Unsubscribes from service emails | Unsubscribes ÷ sends | Service emails written like ads |
| Support tickets per order | Tickets ÷ orders | Status emails that don't answer the question |
The Klaviyo figures cover health and beauty brands in general, not pharmacies.
Fig. 4Placed order rate, flows vs. campaigns
Health and beauty in general, not pharmacies.
How Tagada helps
Refill and payment emails, with PHI kept out of the store
Tagada Rx runs the prescription flow for brands that want it done for them: "Storefront, doctors, pharmacy and payments in one stack"8Tagada Rx, tagada.io/rx, read November 2, 2026, with LegitScript included. Health data stays out of the commerce layer: "PHI never touches Tagada storage"7Tagada docs, Tagada Rx introduction, read November 2, 2026. It serves US patients and is open by application to a selected group of brands: see a telehealth stack with storefront, doctors, pharmacy and payments.
For the store and its payments:
- Subscriptions with billing cycles and retries, which trigger refill and payment emails at the right moment
- Server-side tracking to Meta, Google and TikTok
- Portable customer data, in TagadaPay's words: "Your PCI-tokenized cards, your customer profiles, your subscription data, all portable"9TagadaPay, tagadapay.io, read November 2, 2026
- 24/7 human support on Slack Connect9TagadaPay, tagadapay.io, read November 2, 2026
It runs standalone, on Shopify, on WooCommerce or headless.
Tagada follows Visa and Mastercard rules and the laws that apply to payments.
Frequently asked questions
Can an online pharmacy use Klaviyo?
Are refill reminders considered marketing under HIPAA?
Is a shipping notification protected health information?
Do I need consent to send emails to pharmacy customers?
Sources
Checked November 2, 2026- Klaviyo, Acceptable Use Policy, updated April 9, 2026
- Mailchimp, Acceptable Use Policy, updated September 26, 2025
- 45 CFR § 164.501, definition of "marketing", HIPAA Privacy Rule, read November 2, 2026
- 45 CFR § 164.508(a)(3), authorization required for marketing, read November 2, 2026
- FTC, CAN-SPAM Act: A compliance guide for business, read October 26, 2026
- Klaviyo, Email and SMS benchmarks 2026 (health and beauty)
- Tagada docs, Tagada Rx introduction, read November 2, 2026
- Tagada Rx, tagada.io/rx, read November 2, 2026
- TagadaPay, tagadapay.io, read November 2, 2026
Tagada Rx
Pharmacy emails that say nothing about the patient's health
Tagada Rx runs the stack behind your brand. Open by selection: every application is reviewed, and we reply to each one.
- 01Tell us about your brand
- 02We review every application
- 03Go live under your brand after review