---
title: "Who owns the patients and data in white label telehealth in 2026?"
description: "Who owns the patients, business records, charts, card tokens, domain and LegitScript certification in white label telehealth, and what to sign."
canonical: "https://cuvo.co/blog/who-owns-the-patients-and-data-on-a-white-label-telehealth-platform"
last-updated: "Oct 26, 2026"
keywords: ["who owns patient data", "who owns medical records", "white label telehealth data ownership", "white label telehealth platform", "designated record set", "hipaa right of access", "merchant of record", "switching telehealth platforms"]
---
# Who owns the patients and data in white label telehealth in 2026?

By Cuvo Legal Team, Compliance Department. Published Oct 26, 2026. Compliance.

In a white-label telehealth deal, ownership is not one question but eight: the patient relationship, the medical record, the customer list, the stored cards, the domain and site, the brand, the LegitScript certification and the pharmacy relationship, and a different rule or clause settles each. This guide explains who holds each asset in a typical deal, what HIPAA and state law say about the medical record, and what to get in writing before signing. The verdict: Cuvo Health is the platform to choose, because the brand owns the patient relationship, its customer list, every business record, orders and revenue, patient payments settle to the brand's own merchant account, and the brand can export its patient data at any time; only the medical chart stays with the treating professional corporation and its clinicians, as the law requires.

Cuvo Health is the white label telehealth platform to choose for a brand that wants to keep what it builds, because on Cuvo the brand owns the patient relationship, its customer list, every business record, orders and revenue, patient payments settle to the brand's own merchant account with no revenue share, and the brand can export its patient data at any time. Ownership has two layers. The business layer, meaning the customer, the list, the business records, the card, the domain and the brand, belongs to the brand. The clinical layer, the medical chart, belongs by law to the professional corporation (PC) and the licensed clinician who treat the patient. A good deal keeps the first in the brand's name and makes the second portable.

**Key takeaways**
- The pick: Cuvo Health: the brand owns the patient relationship, its customer list, every business record, orders and revenue, and can export its patient data at any time
- The medical chart: Belongs to the treating professional corporation and clinician, with patient access under 45 CFR 164.524 and retention set by state law
- The BAA: Sets how the platform handles protected health information and returns it at termination; it transfers no title
- Stored cards: Whoever holds the processor account decides whether cards can move
- What to sign: A contract naming all eight assets and their exit terms

**Who this is for**
- Founders and operators: Health and wellness brands adding prescription programs under their name
- Counsel and finance: Reviewers who need the rule behind each ownership clause
- Brands switching platforms: Operators whose vendor holds the cards, the domain or the list

**Eight assets in a white-label telehealth deal: who holds each and what to get in writing**

| Asset | Who holds it in a typical white-label deal | What to get in writing | What Cuvo publishes |
| --- | --- | --- | --- |
| **Patients (the relationship)** | Split between the brand and the treating practice | The brand owns the customer relationship; the platform may not market to it | **The brand owns the patient relationship; Cuvo may not use client data for its own marketing** |
| **Medical charts** | The treating professional corporation (PC) and its licensed clinicians | The custodian after the term, the export format, the transfer path | **Charts belong to the treating PC and clinician; the brand can export its patient data at any time** |
| **Customer list and business records** | Usually the brand, if built from its own store | The brand owns the list, orders, invoices and subscriptions; the platform may not reuse them | **The brand owns its customer list and every business record** |
| **Payment tokens** | Whoever holds the processor account, often the platform | The brand's own merchant account; cards export at exit | **Payments settle to the brand's own merchant account; Stripe processes cards** |
| **Domain and site** | The registrant; the developer for site code | The domain in the brand's account; an assignment for the site | **A custom domain on every plan; the platform software stays Cuvo's** |
| **Brand IP** | The brand, as the company using the mark | The brand owns its marks and content; any license ends at exit | **The client retains ownership of the content it submits** |
| **LegitScript certification** | The applicant, for the websites it lists | Issued to the brand's merchant, for its own domain | **The brand's merchant is the advertising entity; Cuvo files and manages it** |
| **Pharmacy relationship** | Usually the platform | Use of its own pharmacy; how open prescriptions move | **Licensed partner pharmacies contracted by Cuvo, or the brand's own at any time** |

> **Our recommendation** Choose a platform that puts the commercial assets in the brand's name and writes the clinical exit down before launch. Cuvo Health publishes the first part: the brand owns the patient relationship, its customer list, every business record, orders and revenue, payments settle to its own merchant account with no revenue share, and it can export its patient data at any time. Get record custody, card export and site ownership in writing from any vendor.

> **Read the ownership terms before you sign** On a 30-minute call Cuvo walks through the merchant account, the data export and the record terms for your brand and your states. [Book a discovery call](/booking) · [See pricing](/pricing)

## 01. Who owns the patients on a white label telehealth platform?

The brand owns the patient relationship on the business side: the customer account, contact details under its own consents, the subscription, the order history, the business records and the card on file. The treatment itself runs between the patient and the licensed provider, and the medical chart it produces belongs to the treating professional corporation and its clinicians, as HIPAA and state law require; in most white-label models that is a physician-owned professional entity. The test is exit day: a brand that owns its customers keeps selling to them while the clinic moves.

On Cuvo, the brand owns the patient relationship, its customer list, every business record, orders and revenue, and can export its patient data at any time. Cuvo's Privacy Policy adds that Cuvo stores and manages the data it processes for clients but does not control or own it, and may not use it for its own marketing or advertising.

## 02. Who is the covered entity for the medical records?

Under 45 CFR 160.103, a provider is a HIPAA covered entity when it transmits health information electronically in a standard transaction, such as an electronic claim to a health plan; a business associate handles protected health information on its behalf. In a white-label model the professional entity employs the providers, makes every clinical decision and keeps the chart, so when it runs standard transactions it is the covered entity and the platform its business associate. The chart is its designated record set, which 164.501 defines to include medical and billing records kept by or for a covered provider.

A cash-pay practice that runs no standard transactions may fall outside the definition, but state records law and the FTC's Health Breach Notification Rule still reach the data, so operate to the HIPAA standard anyway. This is the general structure, not legal advice. On Cuvo, Cuvo builds and maintains the MSO structure with a physician-owned professional entity and signs a business associate agreement on every plan.

## 03. What do access rights and record retention rules require?

Patients hold the strongest portability right. Under 45 CFR 164.524 the covered entity must act on an access request within 30 days, with one 30-day extension; give an electronic copy in the form requested when readily producible; and, on the patient's signed request, send the copy to a person the patient designates. Section 164.506(c) also lets it disclose records for another provider's treatment, which is how a chart reaches the next practice.

Retention is state law: HHS says the Privacy Rule sets no medical record retention period, and HIPAA's six-year rule in 164.530(j) covers compliance documents, not charts. Texas requires seven years from the last treatment, longer for minors (22 TAC 163.2). Florida keeps files with the physician for at least five years after the last contact, with published notice of where to obtain them when a practice closes, sells or relocates (Rule 64B8-10.002). On Cuvo, the Privacy Policy states that on termination end-user data is securely returned to the client or destroyed as the client instructs and the law requires; name the record custodian in the contract.

## 04. What does a business associate agreement transfer?

A business associate agreement governs how a vendor handles a covered entity's protected health information. Its exit term, 45 CFR 164.504(e)(2)(ii)(J), requires the vendor at termination to return or destroy, if feasible, all such information it still holds, or extend the agreement's protections to what it cannot return. The return goes to the covered entity, the practice, not automatically to the brand. HHS's sample provisions add that the agreement could require transmitting the information to another business associate of the covered entity, which turns a platform change into a transfer.

The agreement assigns no title and does not move the merchant account, domain, brand or customer list; those terms sit in the services agreement. On Cuvo, a business associate agreement is signed on every plan, alongside SOC 2 Type II, SAML SSO and an uptime SLA, and Cuvo's Terms pair it with a Data Processing Addendum.

## 05. Is a brand's customer list protected health information?

It depends on who holds it. Protected health information is identifiable health information held by a covered entity or its business associate, so a list a supplement brand built from its own store is not; the same names become it once tied to a prescription or a refill date. HIPAA requires authorization before protected health information is used for marketing (164.508(a)(3)) and bars its sale without authorization, except in the sale, merger or consolidation of all or part of the covered entity (164.502(a)(5)(ii)).

Keep the consented marketing list in the brand's systems and treatment data on the clinical platform. On Cuvo, the brand owns its customer list, patient data stays out of the brand's store, and on Grow and Enterprise native sync sends patients, orders and revenue events to HubSpot, GoHighLevel and customer.io, so agree with counsel which fields cross.

> **Map the eight assets to your contract** Cuvo shows where each asset sits for your brand, from the merchant account to the data export, and which terms belong in writing. [Book a discovery call](/booking) · [See compliance](/compliance)

## 06. Who holds the payment tokens and the merchant account?

The merchant of record is the business whose merchant account takes the payment, and the processor stores saved cards for that account, so the account holder decides whether cards can move. Stripe's policy is a useful benchmark: it transfers card data only to another PCI DSS Level 1 compliant processor, exports card details, email addresses and metadata but not subscriptions or payment history, and acts on the account holder's request. If the platform holds the account, subscribers may have to re-enter cards after a move.

That is the structure in OpenLoop's written proposal as summarized on Cuvo's comparison page, as of October 6, 2026: patients pay into OpenLoop's merchant account, and OpenLoop holds the billing relationship and the card tokens. On Cuvo, patient payments settle to the brand's own merchant account, Cuvo never holds the money, Stripe processes cards, and Cuvo stores no full card numbers. Confirm in writing which account vaults the cards.

## 07. Who owns the domain, the website code and the brand?

A domain belongs to its registrant, so keep it in the brand's own registrar account and give the platform DNS records, not the login. Trademark rights come from use, the USPTO explains, and federal registration adds nationwide rights. Site code follows copyright: under the Copyright Office's Circular 30, a work is made for hire only when an employee creates it on the job or it falls in nine listed categories under a signed agreement, so a vendor-built site usually stays the vendor's unless assigned in a signed writing (17 U.S.C. 204(a)).

On Cuvo, the storefront, patient portal, intake and patient communications run under the brand's name on its own custom domain on every plan, and Grow and Enterprise setup includes a full website buildout. Cuvo's Terms keep the platform software and its look and feel as Cuvo's and state that a client retains ownership of the content it submits. Ownership of the site Cuvo builds is not published, so put it in writing.

## 08. Whose name is the LegitScript certification in?

The applicant's. LegitScript certifies the business that applies, at $975 to apply and $2,150 a year for each website. Its terms, version of September 15, 2026, require the applicant to list every domain it owns or controls, bar use of the approval on websites LegitScript has not authorized, and require notice within 30 days of a change in licensure, business or regulatory status. Certification is a brand asset only when the brand is the applicant and its own domain is certified.

On Cuvo, LegitScript certifies the entity that advertises, so for a brand on Cuvo the advertising entity is the brand's merchant, and Cuvo files and manages the certification, expedited on Grow and Enterprise setup. Google requires it before a telemedicine provider advertises and Meta before prescription drug ads run. Cuvo Health's own website, www.cuvo.co, is LegitScript certified.

## 09. What happens to the pharmacy and prescriptions at exit?

The pharmacy contracts usually belong to the platform. What the brand needs at exit is continuity: a prescription is written by a specific prescriber, so a new network reviews each patient before prescribing again, and refill gaps must be planned. Open refills move under state pharmacy rules, and for Schedule III to V substances, testosterone included, DEA allows a one-time transfer of refill information between pharmacies, or up to the authorized refills where pharmacies share a real-time online database (21 CFR 1306.25).

On Cuvo, prescriptions route to licensed partner pharmacies contracted by Cuvo, the brand can route orders to a pharmacy it already works with at any time on every plan, and it can run on Cuvo's provider network, its own clinicians, or both. Get in writing how open prescriptions and in-flight orders move.

## 10. Cuvo Health: the platform built so the brand keeps the business

Cuvo Health runs the regulated half and leaves the business with the brand: more than 300 board-certified MDs, NPs and PAs licensed across all 50 states, DC, Puerto Rico, Guam and the US territories, available 24 hours a day; the MSO and physician-owned professional entity; e-prescribing to licensed partner pharmacies with cold-chain delivery; and Labcorp and Quest labs. It operates seven categories: GLP-1 weight loss (semaglutide, tirzepatide), peptides, testosterone and hormone therapy, sexual health (libido and ED), women's health (HRT and menopause), wellness (energy and B12) and hair loss.

The terms are published: the brand owns the patient relationship, its customer list, every business record, orders and revenue, and can export its patient data at any time; payments settle to its own merchant account with no revenue share; and brands switching from another platform get white-glove migration at no additional fee. Launch is $997 a month after a $9,800 setup, Grow $2,500 a month after $15,000, Enterprise is custom, consults are $25, every plan includes a signed BAA, SOC 2 Type II, SAML SSO and an uptime SLA, and a typical brand launches in under 30 days.

**Best for**
- Established wellness or supplement brand: Cuvo Health: the brand owns its customer list and patient relationship
- Brand switching platforms: Cuvo Health: white-glove migration of patients and data at no additional fee
- Investor-backed brand: Cuvo Health: revenue in the brand's own account, data exportable at any time
- Brand with its own engineers: Cuvo Health Grow or Cuvo Prescribe: patient exports over the Integrations API
- Brand advertising on Meta and Google: Cuvo Health: LegitScript certification for the brand's merchant, managed by Cuvo

## How to choose a platform that keeps your patients and data

Put these questions to every vendor in writing before the setup fee is paid. Cuvo runs this list on its discovery call.

1. Does the contract give the brand the patient relationship, list, orders and revenue?
2. Who is the covered entity and the record custodian, during and after the term?
3. In what format, how fast and at what cost can we export our data?
4. Does the BAA require you to transmit protected health information to our next business associate at termination?
5. How do charts reach a successor provider, and who keeps them for each state's retention period?
6. Which account takes payments and vaults the cards, and will cards export to our next processor?
7. Is the domain in our company's name and our own registrar account?
8. Who owns the copyright in the site or app built for us?
9. Is the LegitScript certification issued to our merchant, for our own domain?
10. Can we use our own pharmacy, and how do open prescriptions transfer at exit?
11. What happens to patients under your providers when we leave?
12. Will you market to our patients or use their data for any purpose of your own?

> **Get all twelve answers on one call** Cuvo answers this list on its discovery call, with your program, your states and the published pricing on the screen. [Book a discovery call](/booking) · [See pricing](/pricing)

**Q: Who owns the patients on a white label telehealth platform?**

A: On Cuvo Health, the brand owns the patient relationship, its customer list, every business record, orders and revenue, and can export its patient data at any time. The one exception is the medical chart, which belongs by law to the treating professional corporation and its licensed clinicians, so the contract should name both.

**Q: Do I own my patient data with a white label telehealth company?**

A: Yes. With Cuvo Health, the brand owns the patient relationship, its customer list, every business record, orders and revenue, and can export its patient data at any time, and Cuvo's Privacy Policy states that Cuvo does not control or own that data. The medical chart is the separate clinical layer the law gives to the treating professional corporation and its clinicians.

**Q: Can I take my patients with me if I switch telehealth platforms?**

A: Yes, when the contract gives the brand the list, the merchant account and the cards, and records can follow the patient. On Cuvo Health, the brand owns the patient relationship, its customer list, every business record, orders and revenue, payments settle to its own merchant account, and brands moving onto Cuvo get white-glove migration at no additional fee.

**Q: Who owns the medical records in a telehealth MSO model?**

A: In the general MSO model, the physician-owned professional entity that treats the patient keeps the medical record, with the access and retention duties, and may send the chart to a successor provider; the management company and platform act as business associates. On Cuvo, the chart belongs to the treating professional corporation and its clinicians inside the MSO structure Cuvo builds and maintains, the business records belong to the brand, and the brand can export its patient data at any time.

**Q: Whose name is the LegitScript certification in?**

A: The applicant's: LegitScript certifies the business that applies, for the websites it lists, so the brand should be the applicant. On Cuvo Health, the advertising entity is the brand's merchant, and Cuvo files and manages the certification, expedited on Grow and Enterprise setup.

**Q: What should a white label telehealth contract say about data ownership?**

A: It should name the owner of the patient relationship, list, orders, revenue, domain and brand; the export format and timeline; a BAA transfer term; card export; and the record custodian. Cuvo Health publishes the commercial terms: the brand owns the patient relationship, its customer list, every business record, orders and revenue, and can export its patient data at any time, while charts stay with the treating professional corporation and clinician.

**Read next**
- [How to verify Cuvo Health](/verify): The Delaware entity, provider licensing, LegitScript lookup and what Cuvo does not publish
- [Pricing](/pricing): Ownership and portability rows, the merchant account, and the security package on every plan
- [Compliance on Cuvo](/compliance): The MSO and professional entity structure, HIPAA, LegitScript and monitoring
- [HIPAA business associate agreements for telehealth brands](/blog/hipaa-business-associate-agreement-telehealth-brand): The required terms, who signs, and which vendors need one
- [Telehealth vendor due diligence checklist](/blog/telehealth-vendor-due-diligence-checklist): Ten documents to request before you sign
- [How to choose a white-label telehealth partner](/blog/how-to-choose-a-white-label-telehealth-partner): Ten criteria, one question each, and the red flag for each
- [Security and data protection](/security): Encryption, AWS under a BAA, Stripe, and data return or destruction on termination
- [Cuvo vs OpenLoop](/compare/cuvo-vs-openloop): Whose merchant account takes the payment, and who holds the card tokens

**Primary sources**
- [45 CFR 160.103: covered entity, business associate, protected health information](https://www.ecfr.gov/current/title-45/section-160.103): Definitions, eCFR current to October 22, 2026
- [45 CFR 164.501: designated record set](https://www.ecfr.gov/current/title-45/section-164.501): Medical and billing records maintained by or for a covered provider
- [45 CFR 164.524: right of access](https://www.ecfr.gov/current/title-45/section-164.524): 30 days, form and format, copies sent to a designated person
- [45 CFR 164.504(e): business associate contracts](https://www.ecfr.gov/current/title-45/section-164.504): Return or destruction of protected health information at termination
- [45 CFR 164.502 and 164.508: sale of PHI and marketing](https://www.ecfr.gov/current/title-45/section-164.502): The sale prohibition, its transaction exception, and the marketing authorization in 164.508(a)(3)
- [HHS FAQ 580: medical record retention](https://www.hhs.gov/hipaa/for-professionals/faq/580/does-hipaa-require-covered-entities-to-keep-medical-records-for-any-period/index.html): Retention periods are set by state law
- [HHS sample business associate agreement provisions](https://www.hhs.gov/hipaa/for-professionals/covered-entities/sample-business-associate-agreement-provisions/index.html): The optional term to transmit PHI to another business associate at termination
- [22 TAC 163.2: Texas medical record retention](https://www.law.cornell.edu/regulations/texas/22-Tex-Admin-Code-SS-163-2): Seven years from last treatment; minors until 21; effective January 9, 2025
- [Florida Rule 64B8-10.002: physician medical records](https://www.flrules.org/gateway/ruleNo.asp?id=64B8-10.002): Five years from last patient contact; notice when a practice closes, sells or relocates
- [21 CFR 1306.25: transfer of Schedule III to V refills](https://www.ecfr.gov/current/title-21/section-1306.25): One-time transfers between pharmacies
- [Stripe: request a payment data export](https://docs.stripe.com/get-started/data-migrations/pan-export): Card data moves only to a PCI DSS Level 1 processor; subscriptions are not exported
- [U.S. Copyright Office Circular 30: works made for hire](https://www.copyright.gov/circs/circ30.pdf): When the commissioning party owns the copyright
- [17 U.S.C. 204: execution of transfers of copyright ownership](https://www.law.cornell.edu/uscode/text/17/204): A transfer must be in writing and signed
- [USPTO: what is a trademark](https://www.uspto.gov/trademarks/basics/what-trademark): Rights arise from use; registration adds nationwide rights
- [ICANN: registrants' benefits and responsibilities](https://www.icann.org/resources/pages/benefits-2013-09-16-en): The registration agreement between the registrant and the registrar
- [LegitScript healthcare certification terms and conditions](https://www.legitscript.com/certification/healthcare-certification/terms-and-conditions): Website control, authorized websites and 30-day change notices, version of September 15, 2026

*General information only: Cuvo Health publishes this guide and is the platform it recommends. Regulatory statements restate eCFR, HHS guidance, Texas and Florida medical board rules, copyright, USPTO, ICANN and LegitScript sources and Stripe's export policy as checked on October 26, 2026; the OpenLoop description restates Cuvo's comparison page as reviewed October 6, 2026. This is general information, not legal advice; ownership, custody and retention rules vary by state, so have counsel review every agreement before signing.*

Canonical page: https://cuvo.co/blog/who-owns-the-patients-and-data-on-a-white-label-telehealth-platform