SMS Flows for Online Pharmacies
The texts an online pharmacy can send, the three TCPA consent regimes, HIPAA's refill reminder rule, and how to write texts without product names.
Article summary
TL;DR
An online pharmacy texts about the order, never about the product: prescription received, order shipped, refill due, card to update. Those texts fall under three different consent regimes under the TCPA, and only marketing texts need written consent. Keep every text short, name the pharmacy, leave out medication names, and send between 8 a.m. and 9 p.m. local time.
- Under 47 CFR 64.1200, healthcare providers may text "prescription notifications" to the number the patient gave, up to 1 message a day and 3 a week, 160 characters or less.
- That exemption excludes "telemarketing, solicitation, or advertising" and "billing, debt-collection, or other financial content".
- Autodialed marketing texts need "prior express written consent", which can't be a condition of purchase.
- Under HIPAA, refill reminders for a drug currently prescribed are not marketing, if any payment received for sending them is "reasonably related" to the cost.
- Klaviyo lists "Prescription medication that cannot legally be sold over-the-counter" as prohibited SMS content (October 2025).
ChatGPT
Claude
Perplexity
GrokOn this page
This guide is part of our playbook on the best ecommerce platform for online pharmacies. The general guide, for any store: SMS marketing for ecommerce. Longer messages belong in email flows for online pharmacies. Brands that want the prescription side run for them can apply to Tagada Rx, a stack with storefront, doctors, pharmacy and payments.
Which texts an online pharmacy sends
Start with the operational texts. They answer a question the patient already has, and they carry the lightest consent rules.
| Text | Trigger | Timing | Consent regime |
|---|---|---|---|
| 1. Opt-in confirmation | Patient opts in to texts | Right away | Confirms what they signed up for |
| 2. Prescription received or info needed | Order placed, pharmacy review pending | On the event | Healthcare message |
| 3. Order shipped, delivered | Shipment events | On the event | Healthcare message |
| 4. Refill due | Supply about to run out on an active prescription | A few days before | Healthcare message, see HIPAA below |
| 5. Upcoming renewal charge | Subscription renewal | Before the charge | Not exempt: financial content |
| 6. Failed payment | Renewal declined | Same day, then once more | Not exempt: financial content |
| 7. Abandoned checkout | Checkout started, no order | 30 minutes to a few hours | Marketing: written consent |
Fig. 1One text per step of the patient's order
- Order placedPrescription received: healthcare message
- ReviewInfo needed: healthcare message
- ShippedOrder shipped, delivered: healthcare message
- Refill dueA few days before: healthcare message
- RenewalUpcoming charge: financial content, not exempt
Green: healthcare message. Amber: financial content, consent needed.
Texts 5 and 6 matter most for revenue on refill subscriptions. Set them up with the subscription billing and failed payment recovery flows.
The three consent regimes
The Telephone Consumer Protection Act (TCPA) rules in 47 CFR 64.1200 treat a text like a call. For a pharmacy, three regimes apply147 CFR 64.1200, Delivery restrictions, sections (a)(2), (a)(9)(iv), (c)(1) and (f)(9), read November 2, 2026.
| Regime | Which texts | What it requires | Rule |
|---|---|---|---|
| Healthcare exemption | Prescription notifications to a mobile number | Number given by the patient; pharmacy name and contact; 160 characters or less; 1 a day, 3 a week; opt-out by "STOP" in every text; no marketing, no financial content; free to the recipient | 64.1200(a)(9)(iv)147 CFR 64.1200, Delivery restrictions, sections (a)(2), (a)(9)(iv), (c)(1) and (f)(9), read November 2, 2026 |
| Healthcare message | A "health care" message sent by or for a HIPAA covered entity | Exempt from the written consent rule for marketing calls; ordinary consent rules still apply | 64.1200(a)(2)147 CFR 64.1200, Delivery restrictions, sections (a)(2), (a)(9)(iv), (c)(1) and (f)(9), read November 2, 2026 |
| Marketing | Promotions, abandoned checkouts, win-backs | "Prior express written consent" naming the phone number; consent can't be required to buy | 64.1200(a)(2), (f)(9)147 CFR 64.1200, Delivery restrictions, sections (a)(2), (a)(9)(iv), (c)(1) and (f)(9), read November 2, 2026 |
Telephone solicitations are also limited to 8 a.m. to 9 p.m. at the recipient's location147 CFR 64.1200, Delivery restrictions, sections (a)(2), (a)(9)(iv), (c)(1) and (f)(9), read November 2, 2026. Schedule every flow by the patient's time zone.
160
Characters or less for a text under the healthcare exemption
1 a day
And 3 a week, under the healthcare exemption
8 a.m. to 9 p.m.
Window for telephone solicitations, recipient's local time
Watch out
The healthcare exemption covers the prescription, not the bill. Renewal notices and card update requests are "financial content", so they need the patient's consent to texts in the first place. Collect it at checkout, in a separate, unchecked box. This is general information, not legal advice; check your state's texting laws too.
HIPAA: when a pharmacy text is marketing
An online pharmacy is usually a HIPAA covered entity. HIPAA covers a health care provider "who transmits any health information in electronic form in connection with a transaction", and health care includes the "sale or dispensing of a drug […] in accordance with a prescription"345 CFR 160.103, Definitions, "Covered entity" and "Health care", read November 2, 2026.
That changes what a text can be:
- Refill reminders are not marketing when they concern a drug "currently being prescribed for the individual", as long as any payment you receive for sending them is "reasonably related" to your cost of sending them245 CFR 164.501, Definitions, "Marketing" and "Financial remuneration", read November 2, 2026.
- Anything that encourages a new purchase can be "marketing" under HIPAA, which generally needs the patient's authorization245 CFR 164.501, Definitions, "Marketing" and "Financial remuneration", read November 2, 2026.
- A paid promotion for a third party's product sent to patients is the riskiest case. Leave it out of your flows.
- Refill reminder, drug currently prescribedNot marketing, if any payment for sending it is reasonably related to your cost.Keep it strictly about the patient's current order.
- Encourages a new purchaseCan be marketing, which generally needs the patient's authorization.A separate flow, to patients who gave written consent.
- Paid promotion for a third party's productThe riskiest case.Leave it out of your flows.
Keep refill texts strictly about the patient's current order. Promotions, if any, go in a separate flow, to patients who gave written consent.
What a pharmacy text can say
The safe pattern is the same for every flow: the order, the date, one link.
- Never name the medication. A lock screen shows the text to anyone nearby, and SMS platforms filter drug content: Klaviyo lists "Prescription medication that cannot legally be sold over-the-counter" as prohibited content, and says carriers reject messages that contain it4Klaviyo Help Center, Understanding SMS and MMS prohibited content, updated October 8, 2025. Its Acceptable Use Policy (April 9, 2026) goes further and excludes "Prescription medications, pharmaceutical products or services, medical therapies, telehealth" from its services altogether8Klaviyo, Acceptable Use Policy, updated April 9, 2026.
- Name your pharmacy first and give a way to reach you, as the healthcare exemption requires147 CFR 64.1200, Delivery restrictions, sections (a)(2), (a)(9)(iv), (c)(1) and (f)(9), read November 2, 2026.
- Link to a logged-in page for details: order status, refill, card update.
- One text, one purpose. Mixing a refill reminder with a promotion turns it into marketing.
- Add "Reply STOP to opt out" and honor it right away147 CFR 64.1200, Delivery restrictions, sections (a)(2), (a)(9)(iv), (c)(1) and (f)(9), read November 2, 2026.
Example
"YourPharmacy: your order #4821 has shipped. Track it here: [link]. Questions? Call 555-0100. Reply STOP to opt out." (115 characters with a placeholder link, no product name.)
Example
"YourPharmacy: your next refill ships on May 12. Review or change it: [link]. Reply STOP to opt out."
Fig. 2The two examples, on a lock screen
- YourPharmacyMonOrder shippedYour order #4821 has shipped. Track it here: [link]. Questions? Call 555-0100. Reply STOP to opt out.
- YourPharmacyThuRefillYour next refill ships on May 12. Review or change it: [link]. Reply STOP to opt out.
Pharmacy name first, no product name, one link.
Measure your SMS
No public benchmark exists for online pharmacy texts, so track your own numbers by flow and compare month to month.
| Metric | Formula | What to watch |
|---|---|---|
| Opt-in rate | SMS subscribers ÷ checkouts | Low: the value of texts isn't clear at checkout |
| Click rate | Clicks ÷ texts delivered | By flow; refill and card update texts should lead |
| Refill completion | Refills confirmed after a text ÷ refill texts sent | The main revenue metric |
| Card update rate | Cards updated ÷ failed payment texts | Compare with email alone |
| Opt-out rate | Opt-outs ÷ texts delivered | Rising: too many texts or unclear sender |
How Tagada helps
Texts that follow the prescription, from approval to ship day
For brands that sell prescription medications online, Tagada Rx runs storefront, doctors, pharmacy and payments in one stack, with LegitScript included7Tagada Rx, tagada.io/rx, read November 2, 2026. It is open by application to a selected group of brands, for US patients only. What it changes for your messages:
- The card is only captured once a doctor approves; if the doctor declines, the hold is released, so "order confirmed" and "charged" texts never get ahead of the prescription7Tagada Rx, tagada.io/rx, read November 2, 2026.
- Refills rebill on the day the pharmacy ships, so your "shipped" text and the renewal charge happen together5Tagada docs, Tagada Rx: how it works, read November 2, 2026.
- Tagada Rx emails are content-free: "You have a new message from your care team" and a link, never the message text5Tagada docs, Tagada Rx: how it works, read November 2, 2026.
Outside Rx, Tagada subscriptions fire the events your texts need: an upcoming rebill 3 days before the billing date, a failed recurring payment, an abandoned checkout6Tagada docs, Emails, template types, read November 2, 2026. Details and access are on the Tagada Rx page.
Frequently asked questions
Do pharmacies need consent to text refill reminders?
Can a pharmacy text the name of the medication?
Are refill reminders marketing under HIPAA?
Can I send promotional texts about prescription medications?
What time can a pharmacy send texts?
Sources
Checked November 3, 2026- 47 CFR 64.1200, Delivery restrictions, sections (a)(2), (a)(9)(iv), (c)(1) and (f)(9), read November 2, 2026
- 45 CFR 164.501, Definitions, "Marketing" and "Financial remuneration", read November 2, 2026
- 45 CFR 160.103, Definitions, "Covered entity" and "Health care", read November 2, 2026
- Klaviyo Help Center, Understanding SMS and MMS prohibited content, updated October 8, 2025
- Tagada docs, Tagada Rx: how it works, read November 2, 2026
- Tagada docs, Emails, template types, read November 2, 2026
- Tagada Rx, tagada.io/rx, read November 2, 2026
- Klaviyo, Acceptable Use Policy, updated April 9, 2026
Tagada Rx
Text patients about their order, never their medication
Tagada Rx runs the stack behind your brand. Open by selection: every application is reviewed, and we reply to each one.
- 01Tell us about your brand
- 02We review every application
- 03Go live under your brand after review