How do online clinics legally work with dispensing pharmacies?

Why do online prescribing services need two registrations?

Because UK regulation splits the service at the prescription. Diagnosing and treating patients is a CQC-regulated activity in England. Operating a pharmacy is a GPhC-registered activity under the Medicines Act 1968. An online prescribing service does both. The clinical half — consultations, diagnosis, prescribing, titration and monitoring — is treatment of disease, disorder or injury. It is delivered by or under the supervision of doctors and other listed professionals within a registered provider. The CQC's March 2026 guidance clarification, covered in our ADHD scrutiny analysis, confirmed that pure diagnosis sits outside scope. But the moment a service treats, it is in — and prescribing is treating. The dispensing half is a retail pharmacy business: registered premises, a superintendent pharmacist where the owner is a company, and controlled drug infrastructure where the category demands it. Everything covered from the premises application onwards applies.

Neither registration substitutes for the other, and both halves answer to more regulators than their headline one. Prescribers answer to the General Medical Council (GMC) or their professional regulator. Both entities answer to the Information Commissioner's Office (ICO) as data controllers. The medicines themselves sit in Medicines and Healthcare products Regulatory Agency (MHRA) frameworks for their category. Jurisdiction matters too. The CQC is England's regulator; Healthcare Improvement Scotland, Healthcare Inspectorate Wales and the RQIA in Northern Ireland play the equivalent role. So a service marketing UK-wide should know which clinical regulator its model actually engages.

So the design question is not whether to have both halves but how to hold them. That is where the three structures come in.

One company or two: what are the structural options?

Three patterns cover the market. The dominant one among built-for-purpose operators is two companies in one group. A clinical services company holds the CQC registration and employs or contracts the prescribers. A pharmacy company holds the GPhC registration and the superintendent. Common ownership sits above both.

All three are lawful, and the choice tracks the operator's stage. Partnerships launch clinics fast and remain how most begin. Single-company structures suit small owner-clinician operations. The two-company group is where scaled operators converge: it gives each regulator a clean counterparty, isolates liability and, not incidentally, is far easier to finance and eventually sell in halves. The corporate mechanics underneath are exactly those in structuring a pharmacy business and choosing and appointing a superintendent pharmacist, applied unchanged. That means ownership openness, the superintendent as the pharmacy company's load-bearing appointment, and the one-operating-company rule that gives each pharmacy entity its own superintendent.

Who regulates what across the structure?

Map it once and keep the map current. The fastest way to fail an inspection is answering one regulator with the other's evidence. The clinic entity answers to the CQC for safe, effective, well-led care: the assessment pathway, prescriber recruitment and oversight, clinical governance, incident learning and the remote-consultation model's adequacy. Its prescribers individually answer to the GMC or their own regulator. Those regulators' remote prescribing expectations — the chosen medium must support an adequate assessment — bind the individual whatever the corporate structure says.

The pharmacy entity answers to the GPhC for the standards for registered pharmacies and the distance services guidance. That means the superintendent's justification of every SOP, controlled drug and specials compliance where the category brings them, and prescriber verification and delivery assurance. The whole load is set out across the CBPM rules and the Schedule 2 dispensing guide. Both entities answer to the ICO as controllers of special category data. Both answer to the advertising framework: neither half may promote prescription-only medicines to the public, however the marketing is booked between them. And both answer to the commercial world's diligence, covered below.

The map matters most at the seams. When a delivery failure becomes a patient incident, is it a clinic governance event, a pharmacy SOP event or both? (Both, with a shared record.) When a prescriber's pattern looks wrong, who acts? (The clinic's clinical governance, informed by the pharmacy's data — and the pharmacy's own professional duty does not wait for the clinic.) Structures that answer these questions on paper before the first incident handle them as process. Structures that have not, improvise in front of two regulators at once.

How does prescriber independence survive owning both sides?

By being designed for, declared and evidenced. The integrated model's efficiency and its central conflict are the same fact: the group profits when the prescriber prescribes. Nothing in UK law prohibits common ownership of clinic and pharmacy. But the GMC's expectations on conflicts of interest bind the prescribers, the GPhC's standards bind the pharmacy, and both regulators are alert to models whose economics lean on the prescription.

The disciplines that make integration defensible are drawn from watching this model work and fail across the verticals. Decouple prescriber remuneration from prescribing volume: salaried or sessional, never per-prescription. Declare the ownership relationship between clinic and pharmacy to patients plainly, and state any right to use another pharmacy rather than burying it. Keep clinical protocols, thresholds and decline criteria owned by the clinical side and auditable, so the service can evidence that it says no.

Add the pharmacy's professional independence, protected in writing. The superintendent's authority to refuse a supply, question a prescriber or escalate a pattern must be contractually untouchable by the commercial relationship. And keep the marketing on the service-and-condition side of the POM line, with the spend audited as if a regulator were reading it — because eventually one will. Handled this way, integration is a governance asset: one record from assessment to delivery, one incident process, one accountable group. Handled as a sales funnel with a dispensary at the bottom, it is the model the coming scrutiny exists to find, as sketched for TRT in our market analysis.

What interfaces must be designed and documented?

Five. They are the same five whether the halves share a boardroom or a contract. They are where the patient, the data and the liability cross the corporate line.

The prescription flow. How a prescription moves from clinical decision to dispensing pharmacy, with status visible to both sides and to the patient. It must be form-perfect for the category — FP10PCD and prescriber identifiers where private controlled drugs are involved — and never an email thread. Where both halves work one platform, this interface collapses into a record state change. That is the integrated model's single biggest operational win.

Verification. The pharmacy verifies the clinic's prescribers as if it were unaffiliated, with standing verification lists refreshed on a cycle. Common ownership is not a verification method. An inspector will ask the pharmacy, not the group, how it satisfies itself.

The data interface. Special category data flows between two controllers, or through one, depending on structure. It needs a lawful basis, a data processing or sharing agreement matching the actual flow, and privacy notices that tell the patient the truth about who holds what. The standards are in the patient data security briefing.

Service levels. Agree the prescription-to-delivery interval, stock visibility, shortage escalation and the urgent-prescription route as numbers, with a review cadence. In every vertical this series covers, that interval is both a competitive metric and a governance one.

Incidents and learning. One shared definition of a reportable event, a joint record, and named owners on each side. Then the dispensing error, the delivery failure and the clinical near-miss feed one learning loop rather than two defensive files.

The independent-partnership structure lives or dies on these five being contractual and tested. The group structure lives or dies on them being real rather than assumed — which is harder to notice failing.

How do fitness checks and commercial diligence trace through the structure?

Exactly as they trace through any pharmacy group, but doubled. The GPhC checks the pharmacy company's directors and superintendent. The CQC assesses the clinic entity's fit-and-proper persons. Banks and payment providers trace the whole group to ultimate beneficial owners. Any NHS work brings the fitness regime that reaches through corporate directors to natural persons. So the design rule from structuring a pharmacy businessapplies with extra force. Keep the group drawable on one page, every natural person identified, and registers reconciled across Companies House, both regulators and the shareholders' agreement. Identity verification is now mandatory at Companies House, so inconsistencies surface fast.

Two group-specific additions. First, put the intercompany agreements in the data room from day one: the services agreement between clinic and pharmacy, the data agreement, the trademark and platform licences. Lenders, insurers and eventual buyers will price their absence as risk. Second, decide early which entity owns the patient-facing brand and the platform. That choice quietly determines which company holds the enterprise value. Founders who let it happen by accident discover it during the fundraise.

Key takeaways

FAQs