Identity verification for online pharmacies

What online pharmacies ask of identity checks

An online pharmacy does not meet its patients. It receives an order, and often a prescription, from a screen. The medicine that goes out is tied to a person by two documents that do not talk to each other: the prescription, which names a patient, and the order, which names a customer. The identity check closes that gap. It establishes who the customer is, with a document and a live face, so that the pharmacist can compare that person with the patient on the prescription.

The check is deliberately narrow. It does not judge the prescription, and it does not decide whether a medicine may be sold; those remain the pharmacist's professional duties. What it provides is the first link in the chain: a name and a date of birth that come from a document, and a face that has been matched to that document, so that the pharmacist is comparing like with like. Where the order and the prescription name different people, the pharmacist knows at once that a conversation is needed.

• Establish the customer's name and date of birth from a document, not from a form field.
• Confirm that the person at the screen is the person on the document.
• Hand the verified name and birth date to the pharmacist, who compares them with the prescription.
• Keep health-related orders out of the callback to your systems.
• Recognise a returning patient on a repeat order.

The flow

1. Start. The patient reaches the check from the order page in the web widget, or continues on a phone through a QR code.
2. Questionnaire. The patient enters name, birth date and contacts before the KYC starts.
3. Document. The patient photographs a passport, national ID card, driver's licence or residence permit. The document is read and checked for fraud.
4. Selfie and liveness. The selfie is matched to the document portrait and active liveness confirms a live person.
5. Match to the prescription. Your pharmacy system, or the pharmacist, compares the verified name and birth date with the identification of the patient on the prescription. The platform does not read prescriptions.
6. Callback. A webhook tells your system that the session is complete. The callback can be set up to carry no personal data, and your system reads the details through the API.
7. Repeat order. A returning user is compared with a stored reference face.

Where this differs from the telehealth page

The telehealth page is about a patient who is about to see a clinician and about the controls on access to health records. A pharmacy has a different object at the end of the flow. It is a parcel of medicine, tied to a prescription written by someone else. The decision is not whether to admit a patient to a consultation but whether this person may receive this order, and the evidence that answers it is a name and a birth date that were read from a verified document and that can be compared with a prescription.

Modules used

• Document verification, face verification and liveness.
• Questionnaire and QR hand-off.
• Web SDK and widget for desktop and mobile browsers.
• REST API and webhooks, with a callback that can omit personal data.
• Data controls for retention and erasure settings.
• The telehealth patient identity use case.

Regulatory frame

What two European Union texts say about selling medicines at a distance and about the prescriptions that travel with them. Directive 2011/62/EU of 8 June 2011 amended Directive 2001/83/EC by inserting a title on sale at a distance to the public. Commission Implementing Directive 2012/52/EU of 20 December 2012 lists the elements of a prescription for use in another Member State.

• Article 85c(1) of Directive 2001/83/EC, as inserted, is without prejudice to national legislation prohibiting the offer for sale at a distance of prescription medicinal products to the public by means of information society services.
• Subject to that, it requires the person offering medicinal products at a distance to be authorised or entitled to supply medicinal products to the public in the Member State where that person is established, and to have notified that Member State of the name and permanent address of the place of activity, the starting date of the activity, the address of the website and, if applicable, the classification of the medicinal products offered.
• It requires the website to display on every page that relates to the offer a common logo, with a hyperlink to the entry of the person in the list that each Member State publishes on its website, and Article 85c(3) says the logo is recognisable throughout the Union while enabling the identification of the Member State where the person is established.
• Article 85c(2) allows Member States to impose conditions, justified on grounds of public health protection, for the retail supply on their territory of medicinal products sold at a distance.
• Under Articles 2 and 3 of Directive 2012/52/EU, Member States ensure that prescriptions issued further to a request of a patient who intends to use them in another Member State contain at least the elements set out in its Annex.
• The Annex lists, under identification of the patient, the surname or surnames, the first names written out in full, that is with no initials, and the date of birth.
• The Annex also lists the issue date, the identification of the prescribing health professional with the professional qualification, contact details and signature, and the identification of the prescribed product.

This block describes the texts, not our service. For information; not legal advice.

Sources

• Directive 2011/62/EU of the European Parliament and of the Council of 8 June 2011 amending Directive 2001/83/EC as regards the prevention of the entry into the legal supply chain of falsified medicinal products, Official Journal text, fetched 27 October 2026.
• Commission Implementing Directive 2012/52/EU of 20 December 2012 laying down measures to facilitate the recognition of medical prescriptions issued in another Member State, Official Journal text, fetched 27 October 2026.

Next

Try the interactive tour, read the telehealth patient identity use case or see how data protection works.