What is the pattern?
The pattern comprises retail thinking applied to a regulated catalogue, and it involves nobody's ill intent. A pharmacy owner commissions a website as any small business would, on the basis that the portfolio appears competent, the price is reasonable and the agency has constructed shops previously. The agency then does what agencies do competently, applying e-commerce patterns which maximise conversion, comprising product grids, prices, basket functionality, reviews, urgency messaging and abandoned-cart correspondence, to a product catalogue which happens to consist of medicines.
Every one of those patterns falls somewhere between inappropriate and unlawful for portions of that catalogue, and neither party appreciates this, since the owner assumed that web professionals understand web law whilst the agency assumed that the client understands its own industry's rules.
The site launches and trades, and the difficulties surface subsequently, when an acquirer's underwriter declines, a certifier queries the prescribing flow, an inspector examines the prescription-only pages, or a competitor reports the advertising. The build was inexpensive whilst the subsequent investigation is not.
What does the generic build omit?
The omitted layer is the one which this site's library documents progressively, and which a pharmacy site inherits in its entirety at once.
The GPhC's standards treat the website of a registered pharmacy as part of the registered service, carrying the voluntary logo and registration transparency expectations which follow. Medicines advertising law divides the catalogue three ways, in that GSL retail constitutes retail, P medicines may be sold online only within a supervision and intervention architecture, and POMs may not be advertised to the public at all, which prohibits precisely the product-page pattern which agencies construct first, being the priced, basketed and review-decorated listing, when applied to prescription lines.
Service models introduce the prescribing-flow transparency which the certification and remote-prescribing frameworks require, comprising consultation before checkout, the model described honestly and prescriber independence visible. Health data renders the forms layer consequential, in that a symptom checker feeding a marketing system constitutes a special-category data incident accompanied by a newsletter. The policies layer must state what consumer law actually provides rather than what a template supposed. And the payments layer examines all of it, since the acquirer and the certifier underwrite from the rendered site rather than from the intentions behind it.
None of this is obscure, all of it is discoverable, and none of it appears within a generic brief, which constitutes the failure in a single observation.
What do the failure modes comprise?
A brief survey of what reaches this site's correspondence.
The prescription-only shop. Prescription medicines displayed with prices, stock indicators and basket functionality upon public pages, constituting promotion of POMs to the public, constructed as diligently as any retail grid.
The inverted checkout. Payment taken, followed by a questionnaire, followed notionally by a prescriber, being the sell-first architecture which every regulator and certifier within this library treats as the primary indicator.
The unsupervised P shelf. Pharmacy medicines sold without quantity limits, without an intervention step and without a pharmacist appearing anywhere within the flow.
The testimonial wall. Reviews attached to POM services, with patient endorsements performing the promotion which the law prohibits the pharmacy from performing directly.
The leaking forms. Health enquiries submitted through a general contact form, routed to a shared inbox and a marketing platform, retained indefinitely, upon no identified lawful basis.
The retail policies. Fourteen-day returns promised upon dispensed prescriptions, being the precise opposite of the statutory position, drafted from a template.
The delayed launch. The completed and paid-for site which cannot pass acquirer underwriting or certification review, discovered during the eleventh week of a twelve-week programme.
Each failure constitutes competent execution of an incorrect specification.
Why do subcontracting chains amplify the failure?
An industry mechanic which agency proposals seldom mention is that much of the agency market does not construct websites but sells them, subcontracting production to white-label studios and offshore teams, occasionally through more than one layer. The economics are rational, with sales and account management retained onshore and production placed wherever it is least expensive, and for a bakery's website the model is harmless.
For a pharmacy it fails structurally, since a brief degrades at every handover. The compliance paragraph from the initial meeting becomes a bullet within a scope document, which becomes a ticket describing product pages as per the mock-up, within a queue worked by a developer who has never encountered the Human Medicines Regulations and whose performance is measured upon delivery speed. Nobody within the chain owns regulatory outcomes, no layer is remunerated for raising objections, and the one person capable of identifying the errors, being the superintendent, reviews at the conclusion, once the information architecture, the checkout order and the data flows have been settled.
The remedy is not prohibiting subcontracting, which the brief below addresses candidly, but refusing anonymity. The client knows who is building, the compliance requirements travel as acceptance criteria which survive handover, and a named person holding authority signs each one off. Chains which are visible are manageable, whilst chains which are not constitute where pharmacy sites fail.
What are the economics of the inexpensive build?
Priced honestly, the inexpensive build fails upon arithmetic before principle is reached. The generic quotation wins the tender by thousands, whilst the subsequent ledger comprises weeks of launch delay whilst an acquirer's decline is diagnosed and the site rewritten for underwriting examination, with premises costs, stock finance and staff consuming resources within a business which cannot yet accept a card, remediation conducted under time pressure and, in the least favourable cases, under regulatory attention, which constitutes the most expensive procurement environment available, a second build, since architecture-level failures concerning checkout order, data flows and catalogue structure constitute rebuilds described as corrections, and the indirect costs comprising the certification application delayed by the website, the advertising accounts which cannot open, and the founder-months expended upon investigation.
Set against that, the specialist premium or the additional weeks of a properly briefed generic build do not constitute a luxury but insurance priced at a fraction of the claim. The industry's pricing illusion is that the build cost equals the figure upon the proposal, whereas for a regulated site the build cost equals the proposal figure plus the probability-weighted cost of failing four audiences, and the second term dominates. Owners who have experienced one delayed launch require this paragraph only once.
Who are the five audiences?
A pharmacy website is read by five audiences whilst a generic build serves one. Patients, for whom the agency optimises. The GPhC, whose standards and inspectors treat the site as part of the registered pharmacy. The MHRA and the advertising rules, for which every page constitutes an advertisement carrying a legal classification. The payments layer, comprising acquirers, certifiers and advertising platforms, which underwrites the business from the rendered site as an entire cluster of this library established. And the future, comprising the bank, purchaser or investor whose diligence will eventually read the site as evidence of how the business is conducted. The protective brief exists because four of the five audiences never attend design workshops, and the site which satisfies the first whilst failing the remaining four constitutes the industry's default output.
What does the protective brief contain?
| Clause | What it requires | Acceptance test |
|---|---|---|
| Catalogue classification | Every product tagged GSL, P or POM, with page behaviour specified per class | No POM page displays price and basket to the public, and the P flow includes intervention and limits |
| Service flow order | Consultation and prescriber decision preceding payment for POM services, with the model described truthfully on-page | A test patient cannot reach payment without completing the clinical step |
| Transparency set | Registration details, superintendent, prescriber information, ownership and complaints route displayed per the standards | Every item locatable within two clicks from any page |
| Data map | Every form's fields, destination, lawful basis and retention documented, with health data segregated from marketing | The data map exists as a deliverable and corresponds to the build |
| Policies | Refunds per the statutory matrix, together with privacy, terms and cookies, drafted for pharmacy rather than adapted from retail | Policies cross-checked against the site's actual flows without contradiction |
| Payments readiness | Gateway per the cluster's criteria, card data architecturally excluded, and the site written for underwriting examination | The certification and acquirer questionnaires may be answered from the site without difficulty |
| Accessibility and performance | A stated accessibility standard and performance budget, tested rather than aspired to | Audit reports delivered at handover |
| Named builders and sign-off | Who actually builds, disclosed, together with a named compliance owner and superintendent sign-off gates at architecture, content and launch | A sign-off record exists for each gate |
| Ownership and access | Client ownership of domain, content, code and design, with administrative access to hosting, DNS and analytics from the first day | Access verified before final payment |
| Change control and exit | Post-launch changes to regulated surfaces passing through review, with documentation and priced exit assistance | The change log exists and the exit clause contains figures |
Two clauses carry the greatest practical weight. Sign-off gates relocate the superintendent from end-of-project reviewer to architectural authority, which is where the failures described above become preventable, since the checkout order constitutes a first-gate decision rather than a launch-week discovery. And ownership and access is the clause preventing a compliance difficulty from becoming a dependency, since a pharmacy unable to edit its own prescription-only page on the evening a regulator writes about it does not hold a supplier relationship but a dependency accompanied by invoicing.
Everything within the table constitutes ordinary professional practice, and the only unusual element is recording it, which is precisely why recording it sorts the market.
Generic, specialist or in-house?
The honest position, with the disclosure repeated, is that this site's publisher is a specialist, such that the reasoning rather than the conclusion warrants examination.
A generic agency constitutes a satisfactory choice for a brochure site presenting locations, hours, team and service descriptions, without commerce or health-data capture, operating to the brief's transparency, policy and ownership clauses, since the compliance surface is sufficiently small to be specified completely.
The specialist case strengthens with each regulated feature, comprising P sales, POM services, prescribing integration and subscriptions, since compliance there constitutes architecture rather than copy, and a builder already familiar with the five audiences converts the brief from an education programme into a checklist.
In-house construction suits groups possessing genuine product teams and continuous development requirements, carrying the same brief internally, since employment does not confer regulatory knowledge either.
The incorrect answer within all three approaches is identical, namely any builder, whatever its designation, operating without the brief, since the designation was never the variable whilst the specification always was.
What does the site require after launch?
A pharmacy website is never complete, since its compliance surfaces track a moving framework, and the brief's change-control clause is where the ongoing care resides. Three habits maintain a launched site in an inspection-ready condition.
Change control upon regulated surfaces. Product pages, service flows, policies and claims alter only through the sign-off route, however minor the edit, since a small and apparently harmless amendment to a prescription-only page is the mechanism by which compliant sites drift into advertisements.
A claims review within the content rhythm. Every article, landing page and campaign passes the question which the certifier and the MHRA will pose, namely whether the claim falls within the licence and the evidence, before publication rather than following a complaint.
A standing audit against the five audiences. Quarterly, someone examines the site as a patient, as an inspector, as an advertising regulator, as an underwriter and as a diligence lawyer, employing the brief's acceptance tests as the script, since frameworks move, the present year alone having revised label rules and payments regulation among other matters, and a site which passed in January may fail in July without any code having changed.
The builder relationship should survive launch as retained capacity for precisely this purpose, at documented rates, or the in-house team should own it explicitly. The failure mode is the orphaned site, compliant upon launch and drifting thereafter, which reproduces the generic-build failure pattern slowly through neglect.
Which questions examine any builder?
Seven questions, capable of being posed within one meeting, in respect of which no wrong presentation exists whilst wrong answers do.
Which pages of a pharmacy site may lawfully display a price and a basket, which may not, and upon what basis? Where does the pharmacist appear within a P-medicine purchase upon your build? What occurs, in sequence, between a patient reaching a POM service page and money being taken? Where does the data from a health enquiry form travel, and who else may access it? Who, by name, will write the code and the product content, and who signs off compliance-relevant changes following launch? What will our acquirer and certifier read upon this site, and have your builds passed those reviews previously? And what do we hold, from the first day, which permits us to leave you?
A specialist answers from experience, a capable generalist answers from the brief supplied, and a builder answering with design awards has answered the only question which mattered. The pattern with which this article opened persists because the questions are not asked, and seven questions conclude it.
Key takeaways
- Generic pharmacy-site failure is structural rather than incompetent, comprising retail patterns competently applied to a catalogue within which those patterns are unlawful, under briefs which never mention the rules.
- The omitted layer is the library itself, comprising catalogue classification, service-flow order, transparency, health-data handling, statutory policies and payments readiness, inherited simultaneously.
- Subcontracting chains amplify failure by degrading the brief at each handover, and the remedy comprises named builders, compliance expressed as acceptance criteria, and superintendent sign-off gates at architecture rather than at launch.
- A pharmacy site holds five audiences, comprising patients, the GPhC, advertising law, the payments layer and future diligence, whilst default builds serve one.
- The protective brief comprises ten clauses with acceptance tests, of which sign-off gates and ownership-and-access carry the greatest weight, and recording it is what sorts the market.
- Generic agencies suit brochure sites, specialists earn their premium as regulated features accumulate, and in-house teams require the same brief, since the variable was always the specification rather than the designation.
- Seven questions examine any builder within one meeting, including this site's publisher, which is as it should be.
FAQs
Built to the brief, by the brief's authors.
Our publisher builds pharmacy websites to exactly the brief above, catalogue classification, compliant flows, the data map, underwriting-ready pages, with Dataforge PMR behind the clinical services. Send us the brief from this article and hold us to every clause; that is the point of publishing it. See how it works.
See Dataforge PMR