How to evaluate a white-label telehealth platform: the questions vendors hope you skip

A white-label telehealth platform lets a med spa, a primary care group, or a clinic offer online care under its own name while a vendor runs the technology and, often, the clinical operation behind it. Demos tend to look alike. The storefront is polished, the intake flow is smooth, and the dashboard has charts. The real differences sit in the contract and in how the vendor answers a short list of direct questions.

Here are the questions we think every buyer should ask, why each one matters, and what a good answer sounds like. Ask them of every vendor, including us. Get the answers in writing.

1. Can I export all of my data, in what format, and at what cost?

Your patient records, intake responses, prescriptions, orders, and payment history are the most valuable asset your telehealth program creates. If you cannot take them with you, you do not really own the business.

Ask:

• Is a full export available at any time, not only at termination?
• What format is it in, and is there a documented schema?
• Does the export include clinical notes, attachments, audit history, and subscription states, or only a patient list?
• Is there a fee for export, and is it stated in the contract?

A good answer is a complete, documented export you can run on demand, with no fee or a fee that is written down in advance.

2. Who owns the patient relationship?

Under a white-label model, patients see your brand. That does not mean the contract treats them as your patients. Some agreements restrict you from contacting patients outside the platform, or let the vendor market other services to them.

Ask who controls patient communications, whether the vendor can market to your patients, and what happens to those patients if you leave. A good answer leaves the relationship with you, within the clinical and legal boundaries of the practice that treats them.

3. How is medication priced, and what margin does the vendor add?

This is the question vendors most often hope you skip. Medication can carry a markup layered between the pharmacy's price and the price you pay, and it is not always visible on the order form.

Ask for the pharmacy's price, the vendor's price to you, and the difference, per product. Ask whether that margin can change during the contract. A good answer is a line-item breakdown you can add up yourself.

4. Can I use my own payment processor, and is there a processing override?

Some platforms require you to process payments through their merchant account and add a percentage on top of the underlying processing rate. That override can quietly exceed the platform fee itself at volume.

Ask whether you can bring your own processor, and if not, what rate you pay compared with the rate the vendor pays. A good answer is either full support for your own processor or a disclosed, fixed rate.

5. Can I bring my own clinicians, and what happens if I do not?

If you already have physicians or nurse practitioners, you may want them to treat your online patients. If you do not, you need to know who will.

Ask:

• Can my clinicians work inside the platform, and what credentialing does the vendor require?
• If I use the vendor's clinicians, which legal entity employs or contracts them, and who serves as medical director?
• Who writes and approves clinical protocols?
• How are coverage gaps handled in states where I have no clinician?

A good answer names the professional entity, describes the supervision model, and makes clear that clinical decisions rest with licensed clinicians.

6. What exactly does the BAA cover?

Almost every vendor will sign a business associate agreement. The question is what it covers.

Ask whether the BAA covers every service in the platform, including messaging, AI features, analytics, and file storage. Ask how quickly the vendor will notify you of a breach and what cooperation it commits to. A good answer is a BAA that matches the full product you are buying, not only the core record.

7. Who are your subprocessors?

Your vendor relies on other vendors: a cloud host, an e-prescribing network, SMS and email providers, identity verification, and possibly an AI model provider. Each one may touch PHI.

Ask for the current subprocessor list, whether each one is under a BAA, and how you will be notified when the list changes. A good answer is a written list you can review, with a change notification process.

8. What happens when we part ways?

Every contract ends. Ask about the ending before you sign the beginning.

• What is the notice period, and are there termination fees?
• Will the vendor provide transition assistance, such as continued access during migration, help transferring prescriptions, and cooperation with a new pharmacy?
• How long will the vendor keep your data after termination, and how is it deleted?
• Can patients continue care without interruption while you move?

A good answer describes a transition period, specific assistance, and a defined data return and deletion process.

9. Where are the boundaries on AI?

Many platforms now include AI features. Some are useful. Some reach into clinical judgment in ways that create risk for you and your patients.

Ask what the AI does, what it is not allowed to do, which model provider it uses, whether that provider is under a BAA, and whether PHI is used to train models. A good answer is specific: the AI supports clinicians and operators, for example by summarizing intake or drafting notes for review, and it never diagnoses or prescribes.

10. Can I see the audit logs?

Under HIPAA you need to know who accessed patient information and when. If the vendor holds the logs and you cannot see them, you cannot answer that question for a patient, an auditor, or your own counsel.

Ask whether you have direct access to audit logs for your organization, how long they are retained, and whether they can be exported. A good answer is self-service access with a stated retention period.

A few more worth asking

• Security controls. Ask how data is encrypted, whether MFA and role-based access are enforced, and how the vendor handles incident response. Be cautious with vague certification claims. There is no official certification for HIPAA.
• Pharmacy model. Ask whether compounded products come from 503A pharmacies on patient-specific prescriptions or from 503B outsourcing facilities, and how pharmacy licensure is confirmed for each state. Compounded drugs have not gone through FDA approval, and your marketing must reflect that.
• Synchronous capability. Ask whether the platform supports video visits where a state or program requires them, not only asynchronous review.
• Dashboards. Ask to see the reports you will use every week, with real filters, not a static screenshot.

How Vayra answers these questions

Since we asked you to put these questions to every vendor, here are our short answers. Verify them in our contract like you would anyone else's.

• Data: You own your data. Full export is available, with a documented schema.
• Medication pricing: No hidden medication margin. Pricing is meant to be added up line by line. See pricing.
• Processing: Bring your own payment processor. No undisclosed processing override. See payments and billing.
• Clinicians: Use your own, or use a 1099 provider panel working under a W2 medical director inside Vayra Medical, P.C., the professional corporation that provides clinical services. Vayra Health & Wellness, Inc. is the MSO. See provider network.
• BAA: Available on request. Our compliance page describes our posture.
• Security: Built on Microsoft Azure with encryption in transit and at rest, MFA, role-based access control, and audit logging. See security.
• AI: Vayra Intelligence runs under an Anthropic BAA and never diagnoses or prescribes. See AI.
• Operating experience: We run our own direct-to-consumer practice on the same stack. The dashboards we sell are the ones we use.

If you are evaluating options for a med spa, a primary care practice, or a clinic or hospital, bring this list to the conversation and hold us to it. Book a demo.