Ecommerce OS · Telehealth9 min readUpdated November 3, 2026

The Telehealth Company Tech Stack: Checkout, Subscriptions, Email and Tracking

The layers of a telehealth company's stack, from intake to refill, the 3 decisions that are hard to undo, and where patient data must stop.

Nick Bonnassies, CMO at Tagada · checked against 11 sources

Article summary

TL;DR

A telehealth company runs two stacks that must meet cleanly. The clinical half (intake, clinicians, e-prescribing, pharmacy) handles patient data. The commerce half (storefront, checkout, payments, subscriptions, email and SMS, ad tracking) sells and bills. Three decisions are hard to undo: where patient data stops, who takes which payment, and when the card is charged.

Stripe lists "Telemedicine and telehealth services" as a restricted business that needs approval (read November 2, 2026).
Stripe's agreement says users "must not provide Protected Health Information to Stripe" (amended September 28, 2026).
The FTC alleged in July 2026 that a telehealth company shared health data with ad platforms such as Meta and Snap.
Visa requires a reminder at least 7 days before a trial or intro price ends, so your email tool is part of compliance (April 2026).
Billing on the pharmacy's ship date, not a calendar date, keeps refills in step with deliveries.

Want to go further? Ask

On this page

This guide is part of our playbook on the best ecommerce platform for telehealth companies. The general guide, for any business: what a custom ecommerce checkout must do.

The layers of a telehealth stack

Each layer has one job. The last column is the one that matters most: does this layer touch patient health data?

Layer	Its job	What changes for telehealth	Health data?
1. Storefront and offer pages	Explain the program and the price	NoTreatment claims; landing pages built for ad review	No
2. Intake and consent	Collect medical history and consent	Branching questions, ID check when the offer needs it	Yes
3. Clinician review and visits	A licensed clinician decides	Licensed in the patient's state; sync visit when required	Yes
4. E-prescribing and pharmacy	Send the prescription, ship it	A partner pharmacy, or your own; see online pharmacy payments	Yes
5. Checkout and payments	Take the money	A processor that accepts telemedicine; hold until the clinician decides	No(keep it that way)
6. Subscriptions and refills	Bill the treatment plan	Rebill tied to shipments, pause and cancel online	No(statuses only)
7. Email and SMS	Reminders, refills, failed payments	Content-free messages; trial and renewal notices on time7	Depends on content
8. Tracking and attribution	Tell ad platforms what sold	Server-side events with no health details8	Must be No
9. Support	Patient questions, changes, cancellation	Patient inbox separate from marketing tools	Yes

Fig. 1Two halves of one stack

Clinical half: health data

2. Intake and consentMedical history
then3. Clinician reviewLicensed in the patient's state
then4. E-prescribing and pharmacyPrescription, shipping
and9. SupportPatient inbox

Health data stays on this side

Commerce half: no health data

1. StorefrontProgram and price
then5. Checkout and paymentsHold until the clinician decides
then6. SubscriptionsRebill tied to shipments
and7. Email and SMS, 8. TrackingContent-free, no health details

Statuses only: approved, declined, shipped, payment failed

Only statuses cross the line: approved, declined, shipped, payment failed.

From the layer table above.

The 3 decisions that are hard to undo

You can swap your email tool in a week. These three shape your contracts, your processor approval and your legal exposure.

1. Where patient data stops
Will it receive intake answers, diagnoses or prescription details?
2. Who takes which payment
Are the consultation, the membership and the medication billed by the same merchant?
3. When the card is charged
Can your checkout hold, capture on approval, and rebill on a pharmacy event?

1. Where patient data stops

A health care provider that transmits health information electronically "in connection with a transaction" covered by HIPAA is a covered entity. A vendor that handles that data on its behalf is a business associate4.
Stripe's agreement says users "must not provide Protected Health Information to Stripe"3. So nothing medical goes in product names, descriptors or metadata.
The FTC's actions against Cerebral (2024) and Hims & Hers (2026, allegations) both involve health data reaching ad platforms through tracking tools5 6.

Ask before you choose a tool: will it receive intake answers, diagnoses or prescription details? If yes, it belongs to the clinical half and needs the contract your counsel requires. If no, configure it so it never does.

The payment side of this question is in HIPAA and your payment processor.

2. Who takes which payment

Stripe treats telemedicine as restricted: "approval is specific to each service offer and it may be modified or revoked by Stripe at any time"1.
Stripe says telemedicine businesses "don't need certification from LegitScript", but typically provide "license numbers and information on your processes"2.
Selling the medication itself is a different category ("Card-not-present prescription-only products and pharmaceuticals")1.

Ask before you choose: is the consultation, the membership and the medication billed by the same merchant? See charging the consultation and the medication.

3. When the card is charged

Charging at intake bills patients before any clinician has looked at their case. The FTC alleges Hims & Hers enrolled consumers in recurring plans "shortly after receiving consumers' intake forms"5.
An authorization hold, captured only if the clinician prescribes, avoids that. Tagada's docs put it plainly: "The hold is not clinical approval"10.
Refills billed on the ship date stay matched to what the patient receives9.

Ask before you choose: can your checkout hold, capture on approval, and rebill on a pharmacy event? See how to require a prescription before checkout.

How the layers connect

Events from the clinical half should drive billing and messaging. Health details should not travel with them.

Fig. 2One patient, from intake to refill, statuses only

approved declined or closed routing step

Intake submittedCase ID, offer, amount to hold
sendsCheckoutCard held
thenClinician approvesApproved status
thenPharmacy shipsShip date, tracking number
thenSubscriptionsNext refill on ship dateApproved

What travels is an ID and a status, never the reason.

Illustrative example.

Event	From	To	What should flow	What must not flow
Intake submitted	Intake	Checkout	Case ID, offer, amount to hold	Answers to medical questions
Clinician approves	Clinical review	Payments	"Approved" status	Diagnosis, prescription detail
Clinician declines	Clinical review	Payments, email	"Declined": release the hold	The reason
Pharmacy ships	Pharmacy	Subscriptions	Ship date, tracking number	Medication name
Payment fails	Payments	Email and SMS	Retry schedule, update-card link	Anything clinical
Order paid	Checkout	Ad platforms	Purchase value, event ID for deduplication8	Product or condition names, page URLs that reveal them

Watch out

Two systems that can both bill the same patient cause double charges, and double charges become disputes. Give renewals to one system only.

Build, buy or both

Most telehealth companies combine a clinical platform with commerce tools. The question is how many seams you are willing to maintain.

Approach	What it looks like	Strong point	Weak point
Assemble	Own practice or clinician network, an EHR, Shopify or a funnel tool, a subscription app, an email tool	Full control of each piece	Every seam carries patient data risk and needs its own contract
Clinical platform + commerce tools	A white-label clinical network, then your own checkout, billing and tracking	Fast clinical launch	Billing and clinical statuses live in two systems
One integrated stack	Storefront, clinicians, pharmacy and payments run together	Billing follows clinical events with no glue code	Less freedom to swap one piece

Store choice in detail: Shopify or a sales funnel for your telehealth company.

The stack by stage

Add tools when the stage needs them, not before.

Fig. 3The stack, stage by stage

LaunchIntake, checkout with hold and capture, one approved processor
Repeat patientsRefills on ship date, pause and skip, patient portal
ScaleBackup processor, A/B tests, server-side tracking

Nothing that duplicates billing, at any stage.

From the stage table below.

Stage	Add	Skip for now
Launch	Offer page, intake, clinician coverage for your launch states, checkout with hold and capture, one approved processor, failed-payment emails	Loyalty programs, complex attribution
Repeat patients	Refills on ship date, pause and skip, renewal reminders, SMS, patient portal	Separate tools for every channel
Scale	A backup processor, A/B tests on offers, server-side tracking, attribution, helpdesk with subscription actions	Anything that duplicates billing or sends health data to marketing

Stage details: how to start and scale a telehealth company.

Warning signs your stack is costing you

Patients are charged before review: expect refund requests and disputes. See chargebacks for telehealth companies.
Refills bill on a calendar date while shipments slip, so patients pay for medication they have not received.
Your pixel fires on intake pages with question answers or condition names in URLs.
Renewals fail quietly: no one sees failed payments until churn jumps. See failed payment recovery.
One processor holds every renewal: if it reviews your account, everything stops. See payment routing.

How Tagada helps

The commerce and payment layers of the stack

Tagada covers the commerce and payment layers, with TagadaPay and the processors you already use: "Already on Stripe, NMI or Airwallex? We orchestrate those too."11

Commerce: checkout, order bumps, one-click upsells, A/B tests, Apple Pay and Google Pay
Tracking: server-side events to Meta (Conversions API)
Routing across TagadaPay and processors such as Stripe, NMI and Airwallex, with a cascade to another processor when one is down or times out
Security and data: native 3DS2, device intelligence and a rules engine; "Export your vault, cards, and customers anytime."

Need the clinical layers too? Tagada Rx adds intake, US-licensed clinicians in the patient's state, e-prescribing and pharmacy routing, refills that rebill on the day the pharmacy ships, and "Tagada never persists PHI"9. US patients only, by selection.

Start free

The commerce and payment layers of the stack

Updated on November 3, 2026

Nick Bonnassies

CMO at Tagada

CMO at Tagada. Before Tagada, Nick built direct-to-consumer brands that generated over $115M in sales, raised over $25M in crowdfunding and sold two of them. He also works as a fractional CMO on marketing operations and AI systems.

Frequently asked questions

What software do I need to start a telehealth company?

Intake and consent, licensed clinicians (yours or a network), e-prescribing and a pharmacy partner on the clinical side. A storefront, a checkout, an approved processor, subscription billing, email and SMS, and server-side tracking on the commerce side. Start with the minimum for your launch states and add tools by stage.

Do I need a BAA with every vendor?

Only vendors that handle protected health information for a covered entity are business associates under HIPAA. Your counsel decides whether your model makes you a covered entity. The practical rule is the same either way: keep health data out of tools that do not need it, starting with your processor and your ad pixels.

Can I use Stripe for a telehealth company?

Possibly. Stripe lists telemedicine as restricted, so you need its approval, which is specific to each service offer and can be revoked. It asks for license numbers and process details, not LegitScript. Details in does Stripe allow telehealth services?

Should a telehealth company charge at intake or after the clinician approves?

Holding the card at checkout and capturing only after approval means patients pay nothing if the clinician declines. Charging at intake bills people before anyone reviews their case, which is part of what the FTC alleged against Hims & Hers in July 2026.

Can I put the Meta pixel on my intake pages?

Be careful. The FTC's Cerebral order and its Hims & Hers complaint both involve health data reaching ad platforms. Send purchase events from the server, with a value and an event ID, and no condition, answers or product names. See server-side tracking for telehealth companies.

Sources

Checked November 3, 2026

Tagada

Keep health data in the clinical half, statuses in the commerce half

Funnels, one-click upsells, subscription billing and payment routing, on one customer record.

Start free See pricing

01Create your free account
02Connect your store or build a checkout
03Launch funnels, upsells and subscriptions