Launching a UK telehealth brand without a clear regulatory checklist is the most common founder mistake in this market. The regulators are not hostile, the rules are documented, and the application timelines are predictable. This piece is the practical checklist — CQC, GPhC, MHRA, ICO, ASA, CAP — for first-time brand founders.
Map the layers and which regulator owns each
Five layers of a UK telehealth brand, five regulator footprints. Clinical activities → CQC, GMC, NMC, GPhC. Pharmacy/dispensing → GPhC, MHRA. Marketing and advertising → MHRA, ASA, CAP. Data → ICO. Specials/compounding → MHRA. The first map step is matching each layer of your stack to its regulator. Many founders skip this and discover the boundaries the hard way.
CQC — when you need it, when you do not
CQC registration is mandatory for any provider of regulated activities including treatment of disease, disorder or injury. If your brand provides clinical activities in its own name, you need to register. If you purely partner with an externally-CQC'd clinical group, you may sit outside CQC scope. Get the answer in writing from a UK healthcare-regulatory lawyer before launch.
GPhC — premises, superintendent, standards, inspections
If you operate the dispensing pharmacy, you need GPhC registration with a named superintendent pharmacist. If you partner with a pharmacy, your contract structure must make clear who is responsible for what. GPhC publishes standards for registered pharmacies covering governance, patient experience, premises, and services.
MHRA — distance selling, advertising, specials, medical devices
MHRA distance-selling regulations apply to every UK-facing online medicine sale. The MHRA Blue Guide governs the advertising of medicines to the UK public. MHRA Specials regulations cover compounded preparations. If any layer of your stack touches medicines, MHRA expectations apply. Get them right at design time.
ICO and UK GDPR — registration, DPA, special-category data
Register under UK GDPR. ICO registration fee is tiered from £40-£2,900 based on organisation size. You will also need a Data Processing Agreement with anyone handling patient data on your behalf — your prescriber platform, your pharmacy, your CRM, your hosting provider. DPIA is mandatory for large-scale special-category data processing.
ASA and CAP Code — health advertising guardrails
Every UK health-related ad is subject to the CAP Code. Rule 12 covers medicines and health-related products. ASA enforces. Pre-launch Copy Advice from CAP is a free service and reduces post-launch adjudication risk substantially. Influencer disclosures must use #Ad or equivalent prominent labelling.
A 30/60/90-day compliance setup timeline
Day 0-30: corporate structure, ICO registration, draft policies, decide CQC scope. Day 30-60: GPhC partnership documented, MHRA-aligned advertising templates, DPIA and DPA drafted. Day 60-90: clinical governance framework signed off, ASA pre-launch Copy Advice for launch campaign, internal training on compliance procedures. Day 90: launch readiness review with external counsel.
ICO registration fee is tiered from £40 to £2,900 based on organisation size. The fee is small; the operational obligations are not.
Regulation defines what launch looks like — it is not a thing you handle after launch.
UK telehealth regulation is documented and navigable. The brands that internalise the checklist before designing the product launch cleanly. The brands that treat regulation as a post-launch problem end up either operating outside the rules or pausing launches mid-campaign to remediate. Pick the first path.
