Compliance & Regulation

Last updated: September 21, 2026

Tuly sits at the intersection of several regulated activities: at-home diagnostic testing, telehealth, prescribing, pharmacy fulfillment, and the handling of sensitive health data. Each of these is governed by its own rules at the federal and state level. This page lays out the regulations that apply and how we intend to meet them, so you can understand the guardrails around the service before you use it.

1. Laboratory testing & CLIA

Every Tuly sample is processed by laboratories certified under the Clinical Laboratory Improvement Amendments of 1988 (CLIA), the federal standard administered by the Centers for Medicare & Medicaid Services (CMS) that governs the quality and accuracy of human diagnostic testing in the United States. CLIA certification sets requirements for personnel qualifications, quality control, proficiency testing, and recordkeeping.

• Testing is performed only in CLIA-certified laboratories appropriate to the test's complexity.
• Where a state imposes its own laboratory license (for example, California, New York, and others), our lab partners must hold that license to accept samples from residents of that state.
• CLIA governs how a test is performed; it is separate from the FDA questions below about how a test is marketed.

2. FDA oversight of tests

Diagnostic tests can also be regulated by the U.S. Food and Drug Administration (FDA) as medical devices. This is a nuanced and evolving area, and we want to be precise about it:

• CLIA is not FDA clearance. A test being run in a CLIA-certified lab does not by itself mean the FDA has cleared or approved it.
• Direct-to-consumer marketing raises the bar. Tests marketed directly to consumers generally do not fall under the FDA's historical enforcement discretion for Laboratory Developed Tests (LDTs), and may require FDA authorization — such as a 510(k) clearance or De Novo authorization — to be marketed as a medical device.
• Our approach. For each offering we will determine the correct regulatory pathway with our laboratory partners and counsel, and each test's page will state its intended use, what it can and cannot tell you, and its regulatory status before ordering opens.

3. Telehealth & provider licensing

When you video call a clinician through Tuly, that visit is a regulated medical encounter. Telehealth is governed primarily at the state level, and the controlling rule is the location of the patient, not the provider.

• Clinicians who see you must hold a valid, active license in the state where you are located at the time of the visit.
• Interstate arrangements such as the Interstate Medical Licensure Compact and the Nurse Licensure Compact can speed multi-state licensing, but they do not remove the requirement to be licensed in your state.
• Because state telehealth rules differ, some services may not be available in every state at launch. Each service page will show where it is offered.
• A visit is a genuine clinical assessment. A test purchase or appointment does not guarantee any particular diagnosis, prescription, or outcome — that is always the clinician's independent judgment.

4. Prescribing & online pharmacy

If a clinician determines that medication is appropriate, it can be prescribed and filled through Tuly's partner pharmacy, or you can take the prescription to a pharmacy of your choice. Prescribing and dispensing carry their own requirements:

• A valid prescription requires a legitimate provider-patient relationship and a clinical basis, consistent with state medical-practice and pharmacy laws.
• Dispensing pharmacies must be licensed in the states they serve and operate under state boards of pharmacy.
• Tuly's core women's-health treatments are expected to be non-controlled medications. Where any controlled substance is ever involved, federal law — including the Ryan Haight Act and the DEA's telemedicine rules — imposes additional requirements, and we follow the more restrictive of the applicable federal and state rules.
• You are always free to fill a prescription wherever you choose; use of our pharmacy is optional.

5. Health-data privacy

Sensitive health information at Tuly is governed by more than one framework depending on where it sits in the service. In short: clinical records from visits and lab testing are handled as HIPAA-protected health information via our providers and labs, while the health data you log directly in the app is protected as consumer health data under the FTC Health Breach Notification Rule and applicable state privacy laws.

We cover this in depth on our dedicated pages: see HIPAA & Health Data for how HIPAA and the FTC rule apply, and our Privacy Policy and Cookie Policy for how we collect, use, and protect your data day to day.

6. Advertising & health claims

Health-related marketing is regulated by the FDA and the Federal Trade Commission (FTC), which require claims to be truthful, non-misleading, and substantiated. We hold ourselves to that standard:

• We describe what a test or service does using its actual, validated intended use.
• We avoid implying that a test diagnoses, treats, cures, or prevents disease beyond what its regulatory status supports.
• Educational content is general information and is not a substitute for professional medical advice — see our Medical Disclaimer.

7. Payments, HSA/FSA & PCI

Payments are processed through PCI-DSS-compliant payment providers; Tuly does not store full card numbers on its own systems. We plan to support payment with Health Savings Accounts (HSA) and Flexible Spending Accounts (FSA) for eligible medical expenses. Eligibility is determined by your plan administrator and IRS rules, and we will provide appropriate documentation, such as itemized receipts, to support eligible reimbursement.

8. Accessibility

We are building Tuly to be usable by everyone and design toward the Web Content Accessibility Guidelines (WCAG) 2.1 AA. See our Accessibility statement for details and for how to report a barrier.

9. Regulation at a glance

Here is how the major activities map to the frameworks that govern them:

10. Contact us

Questions about Tuly's compliance and regulatory approach, or need to report a concern? Reach us at Info@tulyhealth.com, or write to Tuly Health, 265 Denison Drive, Mount Pleasant, MI 48858.