The clinic-plus-pharmacy model: how online prescribing services legally structure prescriber and dispenser

Why do online prescribing services need two registrations?

Because UK regulation splits the service at the prescription: diagnosing and treating patients is a CQC-regulated activity in England, while operating a pharmacy is a GPhC-registered activity under the Medicines Act 1968, and an online prescribing service does both. The clinical half, consultations, diagnosis, prescribing, titration and monitoring, is treatment of disease, disorder or injury, delivered by or under the supervision of doctors and other listed professionals within a registered provider; the CQC's March 2026 guidance clarification, covered in our ADHD scrutiny analysis, confirmed that pure diagnosis sits outside scope, but the moment a service treats, and prescribing is treating, it is in. The dispensing half is a retail pharmacy business: registered premises, a superintendent pharmacist where the owner is a company, controlled drug infrastructure where the category demands it, and everything covered from the premises application onwards.

Neither registration substitutes for the other, and both halves answer to more regulators than their headline one: prescribers to the General Medical Council (GMC) or their professional regulator, both entities to the Information Commissioner's Office (ICO) as data controllers, and the medicines themselves to the Medicines and Healthcare products Regulatory Agency (MHRA) frameworks their category sits in. Note also the jurisdiction: CQC is England's regulator, with Healthcare Improvement Scotland, Healthcare Inspectorate Wales and the RQIA in Northern Ireland playing the equivalent role, so a service marketing UK-wide should know which clinical regulator its model actually engages.

The design question, then, is not whether to have both halves but how to hold them, which is where the three structures come in.

One company or two: what are the structural options?

Three patterns cover the market, and the dominant one among built-for-purpose operators is two companies in one group: a clinical services company holding the CQC registration and employing or contracting the prescribers, and a pharmacy company holding the GPhC registration and the superintendent, with common ownership above both.

All three are lawful, and the choice tracks the operator's stage. Partnerships launch clinics fast and remain how most begin; single-company structures suit small owner-clinician operations; the two-company group is where scaled operators converge, because it gives each regulator a clean counterparty, isolates liability and, not incidentally, is far easier to finance and eventually sell in halves. The corporate mechanics underneath, ownership openness, the superintendent as the pharmacy company's load-bearing appointment and the one-operating-company rule that means each pharmacy entity needs its own superintendent, are exactly those in structuring a pharmacy business and choosing and appointing a superintendent pharmacist, applied unchanged.

Who regulates what across the structure?

Map it once and keep the map current, because the fastest way to fail an inspection is answering one regulator with the other's evidence. The clinic entity answers to the CQC for safe, effective, well-led care: the assessment pathway, prescriber recruitment and oversight, clinical governance, incident learning and the remote-consultation model's adequacy. Its prescribers individually answer to the GMC or their own regulator, whose remote prescribing expectations, that the chosen medium must support an adequate assessment, bind the individual whatever the corporate structure says.

The pharmacy entity answers to the GPhC for the standards for registered pharmacies and the distance services guidance: the superintendent's justification of every SOP, controlled drug and specials compliance where the category brings them, prescriber verification and delivery assurance, the whole load set out across the CBPM rules and the Schedule 2 dispensing guide. Both entities answer to the ICO as controllers of special category data, to the advertising framework, since neither half may promote prescription-only medicines to the public however the marketing is booked between them, and to the commercial world's diligence, covered below.

The map matters most at the seams. When a delivery failure becomes a patient incident, is it a clinic governance event, a pharmacy SOP event or both? (Both, with a shared record.) When a prescriber's pattern looks wrong, who acts? (The clinic's clinical governance, informed by the pharmacy's data, and the pharmacy's own professional duty does not wait for the clinic.) Structures that have answered these questions on paper before the first incident handle them as process; structures that have not, improvise in front of two regulators at once.

How does prescriber independence survive owning both sides?

By being designed for, declared and evidenced, because the integrated model's efficiency and its central conflict are the same fact: the group profits when the prescriber prescribes. Nothing in UK law prohibits common ownership of clinic and pharmacy, but the GMC's expectations on conflicts of interest bind the prescribers, the GPhC's standards bind the pharmacy, and both regulators are alert to models whose economics lean on the prescription.

The disciplines that make integration defensible, drawn from watching this model work and fail across the verticals: prescriber remuneration decoupled from prescribing volume, salaried or sessional, never per-prescription; the ownership relationship between clinic and pharmacy declared to patients plainly, with any right to use another pharmacy stated rather than buried; clinical protocols, thresholds and decline criteria owned by the clinical side and auditable, so the service can evidence that it says no.

Add the pharmacy's professional independence protected in writing, meaning the superintendent's authority to refuse a supply, question a prescriber or escalate a pattern is contractually untouchable by the commercial relationship, and the marketing kept on the service-and-condition side of the POM line with the spend audited as if a regulator were reading it, because eventually one will. Handled this way, integration is a governance asset: one record from assessment to delivery, one incident process, one accountable group. Handled as a sales funnel with a dispensary at the bottom, it is the model the coming scrutiny, sketched for TRT in our market analysis, exists to find.

What interfaces must be designed and documented?

Five, and they are the same five whether the halves share a boardroom or a contract, because they are where the patient, the data and the liability cross the corporate line.

The prescription flow. How a prescription moves from clinical decision to dispensing pharmacy, with status visible to both sides and to the patient: form-perfect for the category, FP10PCD and prescriber identifiers where private controlled drugs are involved, and never an email thread. Where both halves work one platform, this interface collapses into a record state change, which is the integrated model's single biggest operational win.

Verification. The pharmacy verifies the clinic's prescribers as if unaffiliated, standing verification lists refreshed on a cycle, because common ownership is not a verification method and an inspector will ask the pharmacy, not the group, how it satisfies itself.

The data interface. Special category data flowing between two controllers (or through one, depending on structure) needs its lawful basis, a data processing or sharing agreement matching the actual flow, and privacy notices that tell the patient the truth about who holds what, per the standards in the patient data security briefing.

Service levels. The prescription-to-delivery interval, stock visibility, shortage escalation and the urgent-prescription route, agreed as numbers with a review cadence, because in every vertical this series covers that interval is simultaneously a competitive metric and a governance one.

Incidents and learning. One shared definition of a reportable event, a joint record, and named owners on each side, so that the dispensing error, the delivery failure and the clinical near-miss feed one learning loop rather than two defensive files.

The independent-partnership structure lives or dies on these five being contractual and tested; the group structure lives or dies on them being real rather than assumed, which is harder to notice failing.

How do fitness checks and commercial diligence trace through the structure?

Exactly as they trace through any pharmacy group, but doubled: the GPhC checks the pharmacy company's directors and superintendent, the CQC assesses the clinic entity's fit-and-proper persons, banks and payment providers trace the whole group to ultimate beneficial owners, and any NHS work brings the fitness regime that reaches through corporate directors to natural persons. The design rule from structuring a pharmacy businesstherefore applies with extra force: keep the group drawable on one page, every natural person identified, registers reconciled across Companies House, both regulators and the shareholders' agreement, with identity verification now mandatory at Companies House making inconsistencies surface fast.

Two group-specific additions. First, put the intercompany agreements in the data room from day one, the services agreement between clinic and pharmacy, the data agreement, the trademark and platform licences, because lenders, insurers and eventual buyers will price their absence as risk. Second, decide early which entity owns the patient-facing brand and the platform, because that choice quietly determines which company holds the enterprise value, and founders who let it happen by accident discover it during the fundraise.

Key takeaways

FAQs