The FDA Sent 113 Telehealth Warning Letters. None of Them Were About the Drug.

Between September 2025 and June 2026 the FDA sent 113 warning letters to telehealth companies selling compounded semaglutide and tirzepatide. We read all of them. Not one letter says the drug is dangerous, mislabeled at the pharmacy, or made wrong. Every one of them cites a sentence on a website.

The charge in all 113 is the same: false or misleading claims under sections 502(a) and 502(bb) of the Food, Drug, and Cosmetic Act. Only six of the 113 mention the drug being unapproved at all. What drew the letter was the copy, meaning the headline, the product name, and the reassuring line under the "add to cart" button.

In brief: All 113 FDA telehealth warning letters from 2025–2026 cite marketing claims rather than the medicine, which is misbranding under FD&C Act §502(a)/(bb). The flagged claims shift each wave, so the compliance surface is your whole website, not one phrase.

That distinction decides who does what. The response letter is counsel's job. Regulatory lawyers frame what you concede and what you defend, and a federal enforcement letter should go nowhere else first.

Counsel's work ends in a mandate, though: the claims come off your website. Someone still has to rebuild the site so it sells without them, keep the next campaign from shipping the same sentence, and prove both to a reviewer. That is not legal work. The reviewer read your website, and the fix lives where the violation did.

What the letters actually charge

Strip the legal citations out and every letter makes one accusation: you said something about this compounded drug that is false or misleading. That makes the drug misbranded the moment you ship it across state lines.

The relevant law is narrow, and it tells you where to look. Section 502(a) makes a drug misbranded if its labeling is false or misleading. Section 502(bb), newer and aimed at this market, extends the same rule to the advertising or promotion of a compounded drug. Both are about what you say, not what you dispense.

Every one of the 113 letters came from a single office inside the FDA, the Office of Compounding Quality and Compliance, and every one ends the same way: fix it, in writing, within fifteen business days.

The letters are near-verbatim copies of each other. Open two from the same wave and the only lines that change are the company name, the URL, and the exact phrases the reviewer pulled off the site. The FDA is working from a template, and a template scales to a fourth wave as easily as it scaled to a third.

The claims changed every wave. The base charge never did.

The FDA did not pick one bad phrase and hunt for it. Across the three waves it kept the original theory and added a new one each time.

Wave 1 went after what you said the drug was. The dominant violation, in 31 of 58 letters, was the sameness claim, some version of "the same active ingredient as Ozempic and Wegovy." Compounded semaglutide is not a generic. A generic drug is an approved copy of an approved drug, and a compounded drug is neither, so the FDA treats the equivalence as false.

From the letters:

• Remedy Meds: "the same active ingredient as Ozempic and Wegovy," the claim in its most common form.
• Dr. Gater's: "Generic Ozempic," the claim in its purest form.

Wave 2 kept the sameness charge and added one that had appeared in no letter before, your packaging. Under 21 CFR 201.1, a name on a drug label without qualification means that party made the drug. The telehealth brands did not compound anything; a pharmacy did. So a vial carrying the seller's name implies a manufacturer relationship that does not exist, and that on its own is misbranding.

From the letters:

• All 30 February letters: product photos on the website showing a vial with the seller's name on the label.

Wave 3 kept both and added a third, claims about the supply chain. Eleven of the 25 June letters flagged some form of "FDA-licensed" facility language. The FDA's response is a flat correction: the agency does not license or approve pharmacies or outsourcing facilities, and no such designation exists. Calling your supplier "FDA-licensed" invents an authorization, and inventing one is the violation.

From the letters:

• Eden: its drugs came from "FDA-licensed 503(a) outsourcing facilities."
• OrderlyMeds: an "FDA-licensed pharmacy."

Three waves, three theories: what the drug is, what your packaging implies, and what your supplier is called. The base charge held the whole time while the surface it covered kept growing.

The company that got the letter three times

One company has already tested whether renaming the storefront helps. A single Utah operator, FitRX, LLC, took a letter in all three waves:

• September 2025, as Zealthy: cited for the sameness claim.
• February 2026, as FitRx: cited for the packaging claim.
• June 2026, as AM RX: cited for the packaging claim again.

Same legal entity each time. The FDA reviewed each new brand's site from scratch and applied the newer, stricter theory. The rebrand did not reset the clock; it bought a fresh audit under tougher rules.

Nearly every company in these 113 letters wrote the same handful of sentences, because the same growth playbook told them to: "same active ingredient as Ozempic," "clinically proven," and a photo of a clean vial with the brand's own logo. The copy converts, so it spread, and the category ended up publishing minor variations of one non-compliant landing page.

If you launched a compounded-GLP-1 telehealth brand in the last two years and hired anyone who had done it before, you almost certainly shipped at least two of the claims in that table. That is not recklessness. The template you inherited was already broken when you got it.

The compounded GLP-1 market went from a shortage-era workaround to around a million U.S. patients in about three years, by Novo Nordisk's own estimate, and no marketing review kept pace with that. The FDA is now reading every site in it.

What each flagged claim should have said instead

The letters do not tell you how to fix the copy, so here is the direct mapping. Each row is a claim type the FDA cited across the 113 letters, why it draws the citation, and the version that says the true thing without the violation.

If your site carries any of the left column today, you already know what your next warning letter will quote.

What a compliant claims process looks like

So many of these letters land because, in most telehealth companies, nobody owns the sentence. Marketing writes the landing page to convert.

The clinical or regulatory lead, if there is one, reviews the intake flow and the prescribing logic, and never sees the homepage copy until a customer or a reviewer quotes it back. The claim ships because the two people who could have caught it were looking at different screens.

A process that survives the next wave closes that gap, and it is less elaborate than it sounds:

• One inventory of every claim you make. The live landing page rather than the one you remember, plus the paid ads, the email sequence, the comparison table, the FAQ, and the product photos. The FDA reviewed all of it, and so should you.
• Each claim mapped to what you can support. "Clinically proven" needs a citation to a study of your product, not the branded drug. "Same active ingredient" needs the qualification the FDA now expects. Most claims either get a source or get cut.
• A gate before anything ships. No public claim goes live without sign-off from the person who understands the regulatory exposure. That is a workflow, not a headcount.
• A record of who approved what, and when. When the letter comes, the fifteen-day response window is manageable if you can show the reviewer a claims inventory and a sign-off trail instead of assembling one under a clock.

None of that is a pharmacy problem or a legal problem. It is the same discipline any regulated marketing operation runs, applied to a market that grew too fast to build it the first time.

A warning letter forces a re-examination of the claims and of every process and partner that put them on your site. Aim it at the durable fix.

The claim theories in these tables changed with each wave, so a site scrubbed against today's theory says nothing about the next one. What holds is a publishing pipeline where every claim maps to evidence you hold and nothing goes live without a sign-off on the record.

That pipeline is governance and content controls, not a rebuild: a claims inventory, an approval gate in your CMS, and a sign-off log. Counsel owns the letter, and configuring the controls is a fixed-scope job. You do not need us to start, though. You need someone in your company to open the website today and read it the way the reviewer did, one claim at a time, asking what would happen if the sentence had to be true.

The FDA is not the only agency reading these sites. On July 29, 2026, the FTC sued Hims & Hers over patient data shared with advertising platforms through tracking tools, which is a different exposure on the same website and has its own article, where PHI actually leaks in a telehealth company. Every enforcement action on both fronts, month by month, is in the telehealth enforcement digest.

The 113 companies that already got a letter learned which sentences the FDA reads. The list is public, the letters are free, and the next wave is being written from the same template as the last three.

This article reports public enforcement actions from the primary documents linked below, and is current as of the date above. Matters described as complaints or proposed actions are allegations that have not been decided, and a settlement is not an admission of liability. Agencies and courts change positions, and we do not revise articles as matters progress. This is general information, not legal advice, and reading it does not create an attorney-client relationship. Igility is not a law firm. Do not act on this, or decide not to act, without advice for your own situation. What your company concedes, defends, or discloses is a decision for your regulatory counsel, on your facts and in the states where you operate. We build the systems that make the next letter less likely.

References

• FDA Warning Letters database — searchable index of all published warning letters. The 113 letters analyzed here were issued on September 9, 2025, February 20, 2026, and June 8, 2026, from the Center for Drug Evaluation and Research's Office of Compounding Quality and Compliance.
• FDA press release, March 3, 2026 — FDA Warns 30 Telehealth Companies Against Illegal Marketing of Compounded GLP-1s.
• FD&C Act §502 — misbranded drugs and devices, including §502(a) false or misleading labeling and §502(bb) false or misleading advertising of compounded drugs.
• Size of the compounded market — Novo Nordisk president David Moore's estimate of around 1 million U.S. patients on compounded GLP-1s, reported by Amy Baxter, PharmaVoice, August 18, 2025.
• FTC v. Hims & Hers — press release and complaint, July 29, 2026, joined by Utah and California through Los Angeles County Counsel.
• 21 CFR 201.1 — the regulation on manufacturer identification on drug labels, cited across the Wave 2 and Wave 3 letters.
• Representative letters quoted above: Remedy Meds, Dr. Gater's, Eden, OrderlyMeds, and the FitRX, LLC series (Zealthy, FitRx, AM RX).