GLP-1 treatments like Mounjaro and Wegovy have reshaped the weight loss market faster than almost any other category in UK private healthcare. The demand is real, the results are well-documented, and patients are actively searching for clinical providers they can trust.
The compliance landscape, though, is strict. The General Pharmaceutical Council (GPhC), Medicines and Healthcare products Regulatory Agency (MHRA), and Care Quality Commission (CQC) all have a stake in how online weight loss services are run. Get it wrong and you're not just risking a fine. You're risking your registration.
This guide covers exactly what a compliant online weight loss clinic looks like in 2026, from assessment design through to prescriber workflow and follow-up protocols.
Table of Contents
- Who Needs to Be Registered and With Whom
- Assessment Form Design: What the Regulators Expect
- Prescriber Workflow and Clinical Decision-Making
- Identity Verification
- Informed Consent and Patient Communication
- Follow-Up Protocols and Ongoing Monitoring
- Record Keeping and Audit Readiness
- What a Compliant Tech Stack Looks Like
- The Shortcuts That Regulators Are Watching For
Who Needs to Be Registered and With Whom
The registration requirements depend on exactly how your service is structured.
If you are an online pharmacy dispensing prescription-only medicines including GLP-1s, you must be registered with the GPhC and display the EU common logo on your website that links back to the GPhC register. This is a legal requirement, not a best practice.
If your service involves prescribers diagnosing or treating patients, you are likely providing a regulated activity under the Health and Social Care Act 2008 and need CQC registration. The CQC defines prescribing as a regulated activity when it forms part of a treatment pathway, which online weight loss services almost always do.
Your prescribers, whether doctors, nurse prescribers, or pharmacist prescribers, must be registered with their relevant body: the General Medical Council (GMC), Nursing and Midwifery Council (NMC), or GPhC respectively. Prescribers working remotely must hold appropriate clinical indemnity for remote consultations and prescribing.
Check all three registration requirements before you launch. Many online weight loss services have launched without CQC registration on the assumption that the GPhC registration covers them. It does not.
Assessment Form Design: What the Regulators Expect
The patient assessment is where most compliance failures begin. A thorough assessment form is not a bureaucratic hurdle. It is a clinical document that justifies the prescribing decision.
For GLP-1 treatments, your assessment must capture, at minimum:
- Current weight and height for Body Mass Index (BMI) calculation, with a minimum BMI threshold clearly defined and enforced
- Relevant medical history including cardiovascular disease, pancreatitis, thyroid conditions, and gastroparesis
- Current medications and relevant interactions (particularly insulin, sulfonylureas, and other diabetes treatments)
- History of eating disorders
- Pregnancy status and contraception use for patients of childbearing age
- Previous weight loss attempts and outcomes
- Alcohol and recreational drug use where clinically relevant
The MHRA's guidance on prescribing GLP-1s requires that prescribers satisfy themselves that the patient meets the licensed indications for the specific product. For Mounjaro (tirzepatide), the licensed indication in the UK is a BMI of 30 or above, or 27 or above with at least one weight-related comorbidity. Your form must make this unambiguous.
Assessment forms should be configurable by your clinical team without developer input. Regulations change, guidance is updated, and your form needs to keep pace. Hard-coded forms that require a code change to update are a compliance liability.
Prescriber Workflow and Clinical Decision-Making
The prescriber reviewing an assessment must have access to the full patient record, not just a summary. This means notes from previous consultations, any prior prescriptions, flagged contraindications from the assessment, and any patient-reported changes since the last order.
A workflow that simply passes an assessment form to a prescriber inbox for a yes or no decision does not meet the standard of clinical care the regulators expect. The prescriber is making a clinical decision and must be able to evidence it.
A compliant prescriber workflow looks like this:
- Patient completes assessment form in full
- System flags any absolute contraindications and blocks the order automatically
- Prescriber reviews full patient record, including the flagged responses
- Prescriber adds a clinical note documenting their decision, including any borderline factors considered
- Prescription is generated and counter-signed where required
- Dispensing team fulfils the order against the prescription
The clinical note at step four is non-negotiable. In a CQC inspection or MHRA audit, inspectors will look for evidence that a qualified clinician made an active, documented decision for every patient. A prescription generated without a clinical note is a finding waiting to happen.
Identity Verification
Prescribing prescription-only medicines to someone whose identity you cannot verify is a serious risk, both clinically and legally.
At minimum, your platform should collect a government-issued photo ID at registration. Many online pharmacies now use automated identity verification services that check ID documents in real time and flag discrepancies. This is no longer the exception. For any service prescribing controlled or high-risk medicines, it is increasingly the expected standard.
For weight loss specifically, identity verification also addresses the risk of patients under 18 attempting to access prescription treatments. Your terms and assessment must make the minimum age clear, and your ID check must enforce it in practice.
Informed Consent and Patient Communication
Every patient must give informed consent before receiving a prescription. That consent must be specific to the treatment, not a generic privacy and terms agreement.
A compliant consent process covers:
- The nature of the treatment and how it works
- Common and serious side effects with clear frequency guidance
- What to do if side effects occur, including when to seek urgent care
- That this is a prescription-only treatment requiring ongoing clinical oversight
- That the patient has read and understood the assessment questions truthfully
Consent should be captured digitally, timestamped, and stored against the patient record. If a patient later claims they were not told about a side effect and you have no consent record, you have no defence.
Patient communication after prescribing also carries compliance weight. Safety information must be sent with every order, either in the package itself or via a clearly documented email sequence. The MHRA expects patients to receive leaflet-equivalent information for every prescription product, even when dispensing remotely.
Follow-Up Protocols and Ongoing Monitoring
Prescribing a GLP-1 and then going silent is not a safe or compliant model. Ongoing monitoring is a clinical and regulatory requirement, not a commercial upsell.
Your follow-up protocol should include:
- Week 4: Check-in on tolerance and side effects. Assess whether the patient is managing the injection correctly. Review any reported adverse events.
- Week 8 to 12: Weight review. BMI recalculation. Assess whether dose escalation is appropriate and clinically justified.
- Ongoing monthly: Repeat assessment for each new prescription period. The prescriber should not auto-renew prescriptions without reviewing an updated patient report.
Patients who report no response to treatment after 12 to 16 weeks at the maintenance dose should be reviewed for treatment continuation. The MHRA and clinical guidance are clear that GLP-1 treatments are not indicated indefinitely in the absence of meaningful weight loss.
Build these checkpoints into your platform as mandatory steps, not optional reminders. If a patient can reach month three without completing a check-in, your workflow has a gap.
Record Keeping and Audit Readiness
A CQC or GPhC inspection will ask to see patient records, prescribing decisions, consent records, adverse event logs, and evidence of prescriber oversight. All of it needs to be accessible quickly.
Your system should store:
- Full patient assessment history with timestamps and version history
- Every prescription issued, the prescriber who issued it, and the clinical note attached
- All patient communications, including consent confirmation and safety information
- Any adverse event reports and how they were handled
- Prescriber qualifications, indemnity, and registration status
Paper records or records spread across disconnected systems are a significant inspection risk. Inspectors expect a single auditable record per patient that tells the full clinical story without needing to cross-reference four different platforms.
Retention requirements under UK GDPR and NHS standards mean records should be held for a minimum of 8 years for adult patients. Your platform must support long-term, secure record storage.
What a Compliant Tech Stack Looks Like
The technology you run your service on shapes how easy compliance is to maintain day to day.
A purpose-built pharmacy or clinic admin platform will include clinical form management, a prescriber review queue, automatic contraindication flagging, prescription generation, and patient record management in one place. Consumer tools cobbled together, such as a Google Form feeding into a spreadsheet with prescriptions issued by email, are not adequate for a CQC-regulated service.
The key requirements for your platform:
- Configurable assessment forms that clinical staff can update without developer support
- Automatic contraindication flagging based on assessment responses
- Prescriber workflow with mandatory clinical notes
- Digital consent capture with timestamps
- Automated follow-up sequences tied to prescription cycles
- Full audit log of every action taken in the system
- Role-based access so only authorised prescribers can issue prescriptions
- Secure patient data storage meeting UK GDPR requirements
If your current system cannot do all of these things, it is not fit for purpose for a regulated online prescribing service.
The Shortcuts That Regulators Are Watching For
The GPhC and CQC have both published guidance specifically addressing poor practice in online prescribing services. Several patterns are being actively scrutinised.
Assessment forms that don't adapt to responses. A form that asks about medical history but does not route patients with flagged conditions to a prescriber for manual review is not doing its job. Logic-based routing is expected.
Prescriptions without consultation. Issuing prescriptions without any live or asynchronous prescriber review is unlawful for prescription-only medicines. Assessment forms, even thorough ones, do not substitute for a prescriber decision.
No adverse event reporting process. Online services must have a clear mechanism for patients to report side effects and for those reports to reach a clinician. A generic contact form is not sufficient.
Auto-renewing subscriptions without clinical review. Subscription models that auto-charge and auto-renew without requiring a patient to complete an updated assessment are incompatible with compliant prescribing. Each new prescription period requires a new clinical justification.
Getting these things right from the start is significantly cheaper than correcting them after an inspection. The regulators are not unsympathetic to growing businesses, but they do expect the fundamentals to be in place.
Book a Free Discovery Call
If you're planning to launch an online weight loss clinic, or if you're running one and want to review your compliance setup, book a free 20-minute discovery call with the Clinic Pro team.
We've built end-to-end platforms for CQC-regulated and GPhC-registered weight loss services and can walk you through exactly what a compliant setup looks like for your specific model.
Book your free call below.
