The Online Pharmacy Tech Stack: Checkout, Subscriptions, Email and Tracking
The 8 layers of an online pharmacy stack, from prescription review to checkout, refills, email and tracking, and the 3 choices that are hard to undo.
Article summary
TL;DR
An online pharmacy stack has eight layers: storefront, prescription intake and review, pharmacy system, checkout, payments, refills, email and SMS, and tracking. Most tools can be swapped later. Three choices cannot: where health data lives, which processor accepts you, and when the card is charged. Make those three first, then add tools by stage.
- Stripe lists "Online pharmacies" as a restricted business that needs extra due diligence (page updated September 22, 2026).
- Shopify Payments does not support "prescription drugs"; Square's US terms exclude internet pharmacies (updated July 30, 2026).
- Shopify's Acceptable Use Policy does not support uploading HIPAA Protected Health Information.
- Since early 2025, Meta has limited lower-funnel conversion events for some health advertisers, as reported by Haus.
- The FTC's Health Breach Notification Rule, amended in July 2024, treats unauthorized sharing of health data as a breach for the businesses it covers.
On this page
This guide is part of our hub on the best ecommerce platform for online pharmacies. The general guide, for any business: custom ecommerce checkout. For brands rather than pharmacies, Tagada Rx bundles storefront, doctors, pharmacy and payments, open by application.
The 8 layers of an online pharmacy stack
Each layer has one job. The third column is what changes when you sell prescription medications.
| Layer | Its job | What a pharmacy needs | Examples of tools |
|---|---|---|---|
| 1. Storefront | Catalog, account, content | NoMedication claims; licensing details shown | Shopify, WooCommerce, headless front end |
| 2. Prescription intake and review | Collect or receive the prescription, let a pharmacist verify it | Nothing ships before review | E-prescribing network, upload and approval workflow |
| 3. Pharmacy system | Dispensing, labels, inventory, records | Licensed in every state you ship to | Pharmacy management software |
| 4. Checkout | Turn visits into orders | A clear line that payment is not approval | Native checkout, checkout and funnel tools |
| 5. Payments | Take the money | A processor that accepts pharmacies, plus a backup | Stripe (after review), high-risk processors |
| 6. Refills and subscriptions | Recurring orders | Charge tied to dispensing, within the prescription | Subscription billing tools |
| 7. Email and SMS | Refill reminders, order updates | NoHealth details in marketing messages | Tools whose acceptable use policy allows pharmacies; Klaviyo's does not11Klaviyo, Acceptable Use Policy, updated April 9, 2026 |
| 8. Tracking and attribution | Tell ad platforms what sold | Purchase signal without health data | Server-side tracking, attribution tools |
Fig. 1The pharmacy side and the commerce side
Pharmacy side, layers 2 and 3
- 2. Prescription reviewA pharmacist verifies it
- then3. Pharmacy systemWhere health data lives: hard to undo
Pharmacy software: nothing ships before review
Commerce side, layers 4 to 8
- 4. CheckoutWhen the card is charged: hard to undo
- then5. PaymentsWhich processor accepts you: hard to undo
- then6. RefillsCharge tied to dispensing
- then7. Email and SMSNo health details
- then8. TrackingPurchase signal without health data
Covered in this guide
Three choices take months to unwind.
Layers 2 and 3 are pharmacy software. This guide covers the commerce side, layers 4 to 8, and how they connect to the pharmacy side.
The 3 decisions that are hard to undo
You can change your SMS tool in a week. These three take months to unwind.
1. Where health data lives
- Keep prescriptions and health answers in the pharmacy system, not in your store, email tool or ad pixels.
- Shopify's Acceptable Use Policy names "uploading Protected Health Information subject to HIPAA" as an activity its platform does not support4Shopify, Acceptable Use Policy, read November 2, 2026.
- HIPAA does not apply to a payment company for the work of "authorizing, processing, clearing, settling" card payments for health care542 U.S.C. § 1320d-8 (Social Security Act, section 1179). It still applies to the rest of your business if you are a covered entity.
- If you are not covered by HIPAA, the FTC's Health Breach Notification Rule may cover you, and it counts "sharing of covered information without an individual's authorization" as a breach6FTC, Complying with the FTC's Health Breach Notification Rule, rule amended July 2024, read November 2, 2026. Ask counsel which rule applies to you.
2. Which processor accepts you
| Provider | Position on online pharmacies |
|---|---|
| Stripe | Restricted"Online pharmacies, including SaaS platforms" need additional due diligence1Stripe, Prohibited and restricted businesses, last updated September 22, 2026, read November 2, 2026 |
| Shopify Payments | Not supported: "prescription drugs" are listed as regulated products2Shopify Help Center, Shopify Payments eligibility, read November 2, 2026 |
| Square (US) | Excluded: "internet/mail order/telephone order pharmacies"3Square, General Terms of Service (US), section 3, last updated July 30, 2026 |
Fig. 2Three providers, three positions on online pharmacies
StripeRestricted: additional due diligence
Shopify PaymentsNot supported
- Square (US)Excluded
Shopify lets you add a third-party provider when you are not eligible for Shopify Payments2Shopify Help Center, Shopify Payments eligibility, read November 2, 2026. Plan for it from day one. More in does Stripe allow prescription drugs.
3. When the card is charged
- Charging at checkout, before a pharmacist has reviewed the prescription, creates refunds when an order cannot be filled. Refunds and "never shipped" orders turn into disputes.
- The alternative is an authorization hold at checkout, captured only once the order is approved, and voided if it is not. See checkout optimization for online pharmacies.
- Few store checkouts do this natively. A Shopify merchant asked in 2024 for an app that would "hold the checkout until the store approves the order"; a reply knew of none9Shopify Community, merchant thread on prescription approval at checkout, November 28, 2024.
Fig. 3Hold at checkout, capture on approval
approved declined or closed routing step
- CheckoutAuthorization hold
- sent toPharmacist reviewPrescription checked
- approvedCapturedOnly once approved; voided if notApproved
Declined at review: the hold is voided, nothing to refund.
How the layers connect
Data should flow from the place where the order is paid, and health data should stay on the pharmacy side.
| From | To | What flows | What must not flow |
|---|---|---|---|
| Checkout | Pharmacy system | Order, patient identity, shipping address | |
| Pharmacy system | Checkout or billing | Approved or declined, shipped | Prescription details |
| Billing | Email and SMS | Refill due, payment failed, order shipped | Medication names in marketing copy |
| Checkout | Ad platforms | A purchase event, deduplicated8Meta for Developers, Deduplicate Pixel and server events, read October 26, 2026 | Product names, health answers |
| Everything | Attribution | Orders and ad costs | Health data |
Watch out
Two systems that can both bill the same patient for a refill cause double charges, and double charges become disputes. Give refill billing to one system only.
The stack by stage
Add tools when the stage needs them, not before.
| Stage | Add | Skip for now |
|---|---|---|
| Launch | Storefront, prescription review, one processor that accepts pharmacies, a checkout with an authorization hold, order and shipping emails | Loyalty programs, complex attribution |
| Refills | Refill billing tied to shipping, failed payment retries, refill reminders by email and SMS | One tool per channel |
| Scale | A backup processor and routing, A/B tests, server-side tracking, attribution | Anything that duplicates billing or puts health data in marketing tools |
Stage details: how to start and scale an online pharmacy.
Warning signs your stack is costing you
Refunds before shipping
Cards charged, then orders declined at review.
Renewals fail quietly
No one sees failed refill payments until patients stop ordering. See failed payment recovery for online pharmacies.
Health data in the wrong place
Product or prescription names in pixel events or email properties.
Reports disagree
Your store, Meta and your attribution tool show three revenue numbers. See server-side tracking for online pharmacies.
One account holds everything
A single processor carries all sales and all refills. See payment routing and backup processors.
How Tagada helps
Layers 4 to 8 around a prescription that is reviewed first
For prescription brands, Tagada Rx puts storefront, doctors, pharmacy and payments in one stack, with LegitScript included.
The card is held at checkout and captured only once a doctor approves; if the doctor declines, the hold is released and the patient pays nothing. Refills rebill on the day the pharmacy ships, and Tagada never stores PHI10Tagada docs, Tagada Rx introduction, read November 2, 2026. Tagada Rx serves US patients only and is open by application to a selected group of brands.
Tagada covers the commerce layers, 4 to 8, standalone or on top of Shopify, WooCommerce or headless.
| Layer | What Tagada does |
|---|---|
| Checkout | One-page checkout, order bumps, one-click upsells, A/B tests, Apple Pay and Google Pay |
| Payments | Routing across TagadaPay and processors such as Stripe, NMI and Airwallex, with one logic; cascade to another processor when one is down or times out, never after a bank decline; or bring your own processor and keep the acquiring relationship |
| Refills and subscriptions | Billing cycles, retries and automatic recovery |
| Tracking | Server-side events to Meta, Google and TikTok |

Frequently asked questions
What software does an online pharmacy need?
Can I build an online pharmacy on Shopify?
Can I use Stripe for an online pharmacy?
Can I hold payment until a prescription is approved?
Can I use the Meta pixel on a pharmacy site?
Sources
Checked November 3, 2026- Stripe, Prohibited and restricted businesses, last updated September 22, 2026, read November 2, 2026
- Shopify Help Center, Shopify Payments eligibility, read November 2, 2026
- Square, General Terms of Service (US), section 3, last updated July 30, 2026
- Shopify, Acceptable Use Policy, read November 2, 2026
- 42 U.S.C. § 1320d-8 (Social Security Act, section 1179)
- FTC, Complying with the FTC's Health Breach Notification Rule, rule amended July 2024, read November 2, 2026
- Haus, on Meta's health and wellness conversion restrictions, November 25, 2024 (secondary source)
- Meta for Developers, Deduplicate Pixel and server events, read October 26, 2026
- Shopify Community, merchant thread on prescription approval at checkout, November 28, 2024
- Tagada docs, Tagada Rx introduction, read November 2, 2026
- Klaviyo, Acceptable Use Policy, updated April 9, 2026
Tagada Rx
Get the layers that are hard to undo right first
Tagada Rx runs the stack behind your brand. Open by selection: every application is reviewed, and we reply to each one.
- 01Tell us about your brand
- 02We review every application
- 03Go live under your brand after review
