Most health and wellness brands think about email compliance the way they think about a fire extinguisher: something you keep around in case of an emergency, rarely inspected, easy to forget. That’s a mistake specific to this category. Health and wellness brands sit at the intersection of four separate regulatory regimes at once, and almost none of the operators running these email programs know which one actually applies to them.
This isn’t a legal technicality that lives in a folder somewhere. Compliance failures in this space show up as real retention damage: spam complaints that erode sender reputation, claims that trigger platform reviews, and consent gaps that turn a quiz flow into a liability. If you run email for a supplement brand, a skincare line, a functional beverage company, or any DTC wellness brand doing meaningful volume, the rules below aren’t optional reading. They’re the baseline your flows and campaigns need to clear before you optimize anything else.
Why compliance is a retention problem, not a legal checkbox
Every health and wellness brand assumes HIPAA is the thing to worry about. It almost never is. HIPAA covers healthcare providers, health plans, and their business associates, not ecommerce brands selling supplements or skincare directly to consumers. That misplaced worry causes two failure modes: brands that ignore the regulations that actually apply because they think they’re covered by the wrong one, and brands that overcorrect on privacy theater while still sending unsubstantiated health claims in their win-back flow.
The regulations that genuinely govern your email program are the FTC’s truth-in-advertising rules, the CAN-SPAM Act’s mechanical requirements, FDA/DSHEA rules if you sell supplements, and a growing set of state consumer-health-privacy laws. None of these are new in the sense of being obscure, but the enforcement environment has changed fast. Between December 2022 and mid-2024, the FTC published new health products guidance, finalized amendments to its Health Breach Notification Rule, and states like Washington activated a health-data privacy law with no revenue threshold and no exemption for small brands. If your compliance thinking is more than two years old, it’s outdated.
Here’s the part that connects directly to your day-to-day metrics: health and wellness email marketing compliance isn’t separate from deliverability, it’s a precondition for it. A spam complaint rate approaching 0.1 percent is already a warning sign in any ecommerce program. Add exaggerated health claims, buried opt-outs, or a quiz that collects health data without proper consent, and you accelerate exactly the kind of subscriber distrust that produces complaints, unsubscribes, and inbox placement problems. Compliance and deliverability are the same conversation wearing different clothes.
Who actually regulates your health and wellness email
Four separate frameworks apply to a typical health and wellness email program, and they rarely overlap in the way people assume.
The FTC governs your claims. The Health Products Compliance Guidance, issued December 20, 2022, replaced guidance that had been in place since 1998 and explicitly covers foods, supplements, OTC drugs, homeopathic products, health equipment, diagnostic tests, and health-related apps. Critically, the guidance defines “advertising” to include digital content and promotional materials distributed through any channel, which means your email flows and campaigns are held to the exact same truth-in-advertising standard as a television commercial or a printed ad. The FTC has settled or adjudicated more than 200 health-claim cases since the original 1998 guidance, and liability doesn’t stop at the brand. Agencies, distributors, retailers, and endorsers can all be named.
CAN-SPAM governs your mechanics. This is the federal law that dictates headers, subject lines, physical addresses, and opt-out handling for every commercial email you send, and it applies regardless of list size or B2B status.
FDA/DSHEA governs supplement labeling and structure/function claims, which matters specifically if you sell dietary supplements. This regime is about what you can say a product does, and what disclaimer has to accompany that claim.
State consumer-health-privacy laws are the newest layer. Washington’s My Health My Data Act is the clearest example, and it’s built specifically for the gap HIPAA leaves open. The law exists because, as Washington’s own legislature noted, health data collected by companies that aren’t traditional healthcare entities, including apps and websites, hasn’t historically been protected the same way. If your quiz asks about sleep issues, digestive health, skin conditions, or fertility goals, you’re likely collecting the kind of data this law was written to cover.
The mistake most wellness brands make is treating these as one blended “health compliance” concept. They’re not. A brand can be fully CAN-SPAM compliant and still be running FTC-violating claims in the same email. A brand can have airtight supplement labeling and still be out of compliance with Washington’s consent requirements in its quiz flow. Each regime needs to be checked separately.
The CAN-SPAM baseline every flow and campaign must pass
CAN-SPAM is the most mechanical of the four regimes, and it’s also the one most brands assume they’ve already handled because they use Klaviyo or another compliant ESP. The platform doesn’t make you compliant. Your setup does.
The FTC’s compliance guide lays out the requirements plainly, and the details matter more than most operators realize:
- Headers must be accurate. The “From,” “To,” and routing information can’t be misleading about who’s sending the message.
- Subject lines can’t be deceptive. If the subject implies a discount, urgency, or content that the email doesn’t deliver, that’s a violation, not just a bad open-rate decision.
- Every commercial email needs a clear indication it’s an ad, unless the recipient gave prior affirmative consent, in which case this specific requirement is waived. Every other requirement still applies even with consent.
- A valid physical postal address has to appear in the email. This is one of the most commonly missed requirements in fast-moving flow builds.
- A working opt-out mechanism must be included and must remain functional for at least 30 days after the send.
- Opt-outs must be honored within 10 business days, with no fee, no login requirement, and no additional steps beyond the original request.
Two details trip up brands that think they’ve covered their bases. First, CAN-SPAM applies to all commercial email, with no exception for B2B messages and no exception for high-volume senders. Second, and this is the one that surprises the most operators, prior affirmative consent from a subscriber does not exempt you from the law generally. It only removes the requirement to label the message as an advertisement. Every other rule, including the opt-out mechanics and the physical address, still applies to someone who signed up for your list yesterday.
The financial exposure is real. Each separate violating email can carry penalties of up to $53,088. That’s not a hypothetical number tied to some massive corporate case, it’s per email, which means a single flow sent to a large segment without a working opt-out link creates a theoretical liability far beyond the cost of just fixing the flow.
There’s also a liability point that matters if you work with an agency: your brand remains legally responsible for CAN-SPAM compliance even when a contractor or agency is doing the sending. Both the promoter and the sender can be held liable. If you’re evaluating a retention or email marketing partner, this is worth asking about directly. A good agency builds compliance checks into flow QA as a matter of course, not as an afterthought.
Health claims in email: what actually counts as substantiated
This is where most wellness brands get into real trouble, and it’s rarely intentional. It usually starts with a copywriter trying to make a subject line punchy or a flow email trying to restate why the product works.
The FTC’s substantiation standard is specific: claims about health benefits or safety require “competent and reliable scientific evidence,” which generally means randomized controlled human clinical testing. Animal studies, in vitro results, observational data, and anecdotal customer stories generally don’t meet that bar on their own, according to McDermott’s summary of the FTC guidance. That single fact should change how you think about every product-benefit email you send.
The qualifier problem is subtler and catches a lot of otherwise careful marketers. Words like “helps,” “may,” “promising,” and “preliminary” feel like safe hedging language, the kind of thing a legal-minded copywriter adds to soften a claim. Under FTC guidance, these qualifiers are often treated as inadequate disclosures rather than protective language. If the underlying claim isn’t substantiated, softening the wording doesn’t fix the problem, it just makes the violation slightly less obvious.
Testimonials deserve their own scrutiny. A customer review that claims a supplement “cured” their anxiety or a skincare product “eliminated” their eczema can’t be used in your marketing if that same claim would be deceptive or unsubstantiated coming directly from the brand. The rule transfers the brand’s own claims standard onto whatever testimonial you choose to feature. If you wouldn’t say it yourself, you can’t let a five-star review say it for you in a campaign. Expert endorsers carry an additional requirement: they need to be genuinely qualified for the claim they’re making, and any material connection to your brand, free product, payment, or affiliate relationship, needs to be disclosed.
This has a direct, practical effect on lifecycle copy that health and wellness brands rely on constantly. Restating the product’s core promise in concrete terms is a technique that works well in win-back and replenishment flows, reminding a lapsed customer why they bought in the first place. But “concrete terms” has to mean the substantiated outcome, not an escalated version of it. A win-back email that says “get back the sleep you’ve been missing” needs to be describing what the product is actually shown to support, not implying a guaranteed medical result. The same discipline applies to replenishment flows: reminding someone their supplement is running low is fine, implying they’ll relapse into a health problem without it edges into a claim you likely can’t substantiate.
Supplement-specific rules under FDA and DSHEA
If you sell dietary supplements, a second regulatory layer sits on top of the FTC’s advertising rules, and it’s easy to conflate the two. FTC governs your promotional claims; the FDA governs your product labeling. They overlap in spirit but they’re legally distinct, and the boundary matters for how you use language in email specifically.
Under DSHEA, supplement brands can make structure/function claims (a claim about how a nutrient affects the body’s structure or function), general well-being claims, and nutrient-deficiency claims, but only with substantiation behind them, and never a disease claim. You cannot say a product diagnoses, treats, cures, or prevents any disease. Any structure/function claim also requires notifying the FDA within 30 days of first putting that claim into the market.
The mandatory disclaimer is where most operators get confused, especially after a recent FDA update. The regulation, 21 CFR 101.93(d), requires the boldface statement: “This statement has not been evaluated by the Food and Drug Administration. This product is not intended to diagnose, treat, cure, or prevent any disease.” The FDA’s original rule required this disclaimer on every panel or page of labeling where a claim appears, including catalogs and pamphlets. On December 11, 2025, the FDA issued a letter stating it will exercise enforcement discretion on the strict “each panel” placement requirement, while continuing to require the disclaimer to appear on the label itself and be linked to each claim it’s addressing.
Don’t misread that update. The disclaimer itself is not going away, and the enforcement discretion is about physical placement mechanics on product labeling, not about your marketing emails broadly. It’s worth being precise here because a lot of secondhand summaries blur this line: FDA labeling law and FTC advertising law are separate systems. The defensible way to think about your email program is this: FTC’s truth-in-advertising principles apply directly to your emails, and any disease claim you make in a marketing email, regardless of whether the disclaimer appears anywhere, undermines the legal status of your product as a supplement rather than a drug. Don’t rely on a disclaimer to rescue copy that shouldn’t have made the claim in the first place.
Health data in your email program: quizzes, inferences, and consent
This is the newest and least understood risk area, and it sits precisely on top of a tactic most wellness brands already use heavily: the quiz flow.
Zero-party data collection through quizzes is one of the most effective segmentation tools available to health and wellness brands. A skin-type quiz, a sleep assessment, a gut-health questionnaire, these all produce declared-intent segmentation that makes flows and campaigns dramatically more relevant. The problem is that this same data can qualify as regulated “consumer health data” under newer state laws, and the definition is broader than most marketers expect.
Washington’s My Health My Data Act, codified at RCW 19.373, defines “collect” to include inferring or deriving health data, not just directly asking for it. That means if your purchase behavior data lets you infer something about a customer’s health status, weight-loss product repurchases suggesting an ongoing health goal, for example, that inference itself can fall under the law’s protections, even if you never asked a health question directly.
The consent standard is strict. It has to be an opt-in, a clear affirmative act, and it cannot be buried inside general terms of use or obtained through a dark pattern, meaning a pre-checked box or confusing consent flow won’t hold up. Regulated entities also have to prominently publish a Consumer Health Data Privacy Policy link on their homepage, not tucked away in a footer link three clicks deep. Violations are treated as per se violations of Washington’s Consumer Protection Act, which raises the stakes considerably compared to a typical privacy-policy gap.
The timeline matters because these obligations are all now live, not upcoming. The law took effect for general provisions on July 23, 2023, for regulated entities on March 31, 2024, and for small businesses on June 30, 2024, according to the Washington Attorney General’s guidance. It applies to any business targeting Washington consumers regardless of where the company is headquartered, and there’s no revenue threshold that exempts smaller brands.
There’s a second layer worth knowing if you run any kind of health app, connected device, or diagnostic quiz that produces personalized results: the FTC’s Health Breach Notification Rule. The FTC finalized amendments to this rule on April 26, 2024, effective July 29, 2024, clarifying that companies not covered by HIPAA, including health apps and similar technologies, must notify consumers, the FTC, and sometimes the media when there’s a breach of unsecured identifiable health data, and that “breach” includes unauthorized disclosures, not just hacking incidents. The FTC has already brought enforcement actions under this rule against companies including GoodRx and Easy Healthcare, so this isn’t theoretical.
Building a compliance-aware lifecycle without losing performance
None of this means health and wellness brands need to strip the personality or persuasion out of their email programs. It means building flows with the same discipline you’d apply to deliverability or segmentation, checking the mechanics before you scale the volume.
Start with your welcome flow. If it introduces a quiz or asks any question that could reveal health status, sleep issues, digestive concerns, mental health, chronic conditions, the consent language around that data capture needs to be explicit and separate from your general marketing opt-in. Bundling “sign up for emails” with “answer these health questions” in one blanket checkbox is the exact pattern Washington’s law was written to stop.
Your quiz and flow copy should lean into substantiated outcome language rather than aspirational claims. This is a copywriting discipline, not a legal one: describe what customers report or what the product is shown to support, and avoid language that implies diagnosis, treatment, or guaranteed results. This is where the site’s existing win-back guidance already points in the right direction, restating the core promise in concrete terms works, as long as “concrete” means substantiated, not exaggerated.
Maintain the 60/40 balance between value and promotional content, but apply an extra filter specific to this category: value content in health and wellness (educational emails about ingredients, usage, or wellness habits) is exactly the content most likely to drift into unsubstantiated claims if it’s not reviewed. A blog-style educational email about “how magnesium supports better sleep” needs the same claims discipline as a product promotion, because the FTC doesn’t distinguish based on whether you were trying to sell something in that specific email.
Sunset flows and list hygiene matter more in this category than most others. Subscribers who never engage represent both a deliverability risk and, if they were captured through a health quiz, a lingering data-retention question. Cleaning inactive segments regularly reduces both risks at once.
Compliance as a deliverability moat
Here’s the strategic reframe worth sitting with: everything above isn’t a constraint on performance, it’s a structural advantage over competitors who treat compliance as an afterthought.
Honest subject lines and accurate claims produce fewer spam complaints. Consent-based list growth, real opt-in, not purchased lists or bundled checkboxes, produces subscribers who actually want to hear from you, which shows up directly in engagement rates and inbox placement. A working, fast opt-out process reduces the number of frustrated subscribers who report your email as spam instead of just unsubscribing, and spam complaints hurt sender reputation far more than a clean unsubscribe ever will.
If your program is already tracking toward that 0.1 percent complaint-rate warning threshold, the fastest thing to audit isn’t your send frequency, it’s your claims and your consent flows. Brands that get compliance right structurally protect the exact metrics, primary inbox placement, low complaint rates, sustained list health, that determine whether the rest of the retention program even has a chance to work. At Retention Side, this is why we treat compliance review as part of deliverability diagnostics for health and wellness clients, not a separate legal exercise bolted on afterward. The brands winning in this category aren’t the ones with the most aggressive claims. They’re the ones whose email programs are trusted enough to keep landing in the inbox.
Where this leaves you
Health and wellness email compliance isn’t one law, it’s four separate systems that happen to intersect in your Klaviyo account: FTC substantiation standards on your claims, CAN-SPAM’s mechanical requirements on every send, FDA/DSHEA rules if you’re a supplement brand, and state health-privacy laws on anything your quizzes and segmentation infer about a customer’s health. None of them require you to water down your marketing. They require you to know which one applies, build the consent and claims discipline into your flows from the start, and treat the resulting trust as the deliverability asset it actually is.