A direct to consumer lab testing platform sells like an online store and runs like a clinical ordering system. The decisions that settle whether yours can launch sit behind the checkout button, where your customer never looks.
Back there, the platform is four layers. You build one of them, and you buy or contract for the other three.
DirectLabs, a company that was neither a laboratory nor a medical provider, settled with New York’s attorney general in 2015. It had paid a chiropractor $1 per requisition to sign orders for roughly 1,100 consumers he never met or spoke with.
In three English regions in 2022, only 22.8% to 57.9% of orders for a mailed blood self-sampling kit ended with a sample a lab could process. The ASSIST program reported the figures in Sexually Transmitted Infections in 2026.
The whole build hangs on one seam: a consumer checkout has to become a clinical requisition. Before you wire it, decide what the test is actually for.
How do you build a direct-to-consumer lab testing platform?
Build the consumer application and buy or contract for the other three layers: a CLIA-certified partner lab, an ordering clinician whose involvement meets New York’s Wadsworth standard, and a collection route that sets your test menu. The hard work sits where checkout becomes a clinical requisition and where results arrive coded against each lab’s own reference range. AI explanations can display those results; once they interpret them, they fall inside FDA’s device definition.
Key Takeaways:
- You build the seam, and the storefront is the part you can buy. A white-label portal covers the consumer screens; the project is turning a checkout into a requisition a contracted clinician can stand behind under New York’s Wadsworth standard.
- The collection route sets your test menu before you pick one. A lab’s self-collection list caps a kit-only menu, and blood kits can fail before the assay. A CBC needs a draw, and Quest’s in-home collection fee is out of pocket for your customer.
- AI explanations and affiliate pay are where product calls turn legal. An AI that interprets a value instead of displaying it meets FDA’s device definition, and flat affiliate pay is the safe design under either reading of EKRA.
Table of contents
- The DTC lab testing market rewards two different products
- Do you need a doctor to order lab tests? CLIA hands that question to state law
- The four layers of a DTC lab platform, and where a lab ordering API stops
- You integrate with a CLIA-certified lab, you do not become one
- Collection is the layer that limits your test menu
- Results arrive as coded observations, and the reference range belongs to the lab
- The results experience is the product
- Your AI explanations become a device the moment they interpret instead of display
- Cash-pay changes which kickback law applies and which states let you mark up
- Before you build a lab testing platform, lock these decisions in order
- How Topflight Apps can help
The DTC lab testing market rewards two different products
The same blood panel is either the thing you sell or the thing that qualifies a customer for something else you sell. If you’re building a Function Health alternative, that choice shapes what your consumer lab testing software has to do, so make it before anything gets scoped.
Selling the test as the product runs at a filed loss
By our arithmetic, GRAIL put about $615 of commercial spend behind each Galleri test it sold in Q2 2026: sales and marketing spend divided by tests sold, both lines from its 10-Q filed August 6. The company’s GAAP gross margin for the quarter was about negative 28%.
Two caveats travel with the $615. It’s commercial spend per test sold, so it includes a field sales force and brand advertising. And GRAIL says in the filing that the test isn’t broadly reimbursed.
Function Health, Everlywell and Hims & Hers Labs distribute that test, per GRAIL’s February 2026 results release.
Inside a subscription, the test qualifies a customer you already have
More than 60% of new testosterone customers in Q3 2025, when the testosterone offer launched, already subscribed to another Hims & Hers offering, per the company’s shareholder letter. The offer is gated by at-home lab testing, so these are existing subscribers arriving at hormone testing.
If you started out building a GLP-1 virtual clinic, the lab test works the same way: it qualifies a patient who’s already in your care.
A founder on the standalone side says it outright. Superpower cofounder Max Marchione told Sherwood News on December 17, 2025, that blood testing is a bad business, and that the business “has to be actually taking care of someone once they’re in the door.”
Do you need a doctor to order lab tests? CLIA hands that question to state law
There’s no federal physician order requirement for a consumer’s lab test. CLIA asks for an authorized person, and who counts is up to each state.
CLIA requires an order from an authorized person, and state law defines who that is
Under 42 CFR 493.1241(a), the lab must hold a written or electronic request from an authorized person.
42 CFR 493.2 defines that person as an individual authorized under state law to order tests or receive test results, or both. That definition is the hinge. Federal law sets the requirement and the states alone decide who meets it, which is why the answer changes at a state line.
Where state law lets consumers order for themselves, they’re the authorized person and federal law requires no physician order.
Permission to self-order runs test by test
Even where a state allows it, self-order permission attaches to specific tests. California’s Business and Professions Code 1246.5, as of January 1, 2026, limits self-ordering to a short list of analytes (pregnancy, glucose, cholesterol, occult blood) plus any analyte with an FDA-approved over-the-counter test kit. An over-the-counter collection device doesn’t count as one of those kits.
A broad longevity panel runs well past that list.
A single national test menu runs through a contracted ordering clinician
That gap is why platforms contract for an ordering clinician: one national menu needs someone authorized to order in every state you sell into. Quest Consumer’s online blood test platform, questhealth.com, sells tests without a doctor visit because PWNHealth clinicians order them.
Whether you build your own medical group or contract for a physician network is its own call.
The ordering clinician has to be substantially and meaningfully involved
Contract for a telehealth physician network, and the next question is what standard its orders have to meet.
New York’s Wadsworth Center guidelines, quoted in the state attorney general’s 2015 settlement, set three conditions for a provider who authorizes lab testing. The provider:
- uses the result in their professional practice
- is “substantially and meaningfully involved” in ordering and interpreting the tests
- has no compensation arrangement with the analytical laboratory
That involvement requires a patient-physician relationship that, at minimum, includes taking a medical history and keeping patient-specific medical records.
The same settlement shows the standard enforced. Direct Laboratory Services (DirectLabs), which it describes as neither a laboratory nor a medical provider, paid a New York-licensed chiropractor $1 per lab requisition to authorize tests for roughly 1,100 consumers he never met or spoke with. That’s the no-history, no-record failure mode in practice.
Design your intake flow against two failure modes: per-requisition fees paid by the laboratory, and orders with no history and no record. That holds whether your clinician signs each order or works from a standing order.
The order also names who gets a critical-value alert: under 42 CFR 493.1291(g), the lab alerts whoever requested the test. In a DTC build that’s your ordering-clinician network, so whether anyone then calls your customer is a term in your contract with that network.
The four layers of a DTC lab platform, and where a lab ordering API stops
A DTC lab platform is four layers: the certified lab that runs the assay, the clinician who signs the order, the collection method, and the application the consumer touches. You build the application layer. That’s where a consumer checkout has to come out the other side as a clinical requisition, which is the work the storefront hides.
You build one layer and buy or contract for the other three
For each layer you can go through a vendor or go direct, and part of it stays yours either way.
| Layer | Buying looks like | Going direct looks like | Stays yours either way |
|---|---|---|---|
| The certified lab that runs the assay | An ordering vendor’s CLIA-certified partner lab | Your own account with a national laboratory | The menu you expose and the requisition your product generates |
| The clinician who signs the order | Contract for the physician network of a vendor such as Vital (Junction), imaware or Rupa Health, bundled by default or priced on top of its ordering API | Your own lab relationship and ordering provider | The intake record behind the order, and the explanation of results |
| The collection method | A vendor that ships kits or sends a phlebotomist | Your lab’s own kits or draw sites | The choice of route |
| The application the consumer touches | A white-label portal and kits | Building the seam yourself | The checkout-to-requisition seam and the results experience on top of it |
A lab ordering API covers the order and the result
Junction’s lab testing overview, accessed September 11, 2026, says its lab ordering API covers order placement, collection coordination, order status and structured results from partner labs that page doesn’t name. Coverage varies by modality, partner lab and location, and you check it per ZIP through an area-info endpoint.
The application layer is purchasable too: imaware’s platform page, accessed September 11, 2026, lists a white label lab testing portal and test kits. That’s the storefront, and the seam behind it still needs building.
Going direct to a national lab starts with a sales cycle
Ask Labcorp’s undated provider FAQ how to set up an account, and the answer is a form requesting a visit from one of its representatives.
Medplum’s undated guide to ordering through Health Gorilla says you keep your own account number with the lab, and that the lab can refuse you if your volume falls below its threshold. The guide gives no number.
The same build-versus-buy call runs on the prescribing side, and our guide to integrating e-prescribing into a medical app works it through.
The bought physician layer signs the order and stops there
Junction publishes the scope of the physician layer it sells. Its undated physician docs describe three responsibility models, and in each one its network is notified of critical results. Its pricing page draws the limit: Junction provides the order, with no consults and no personal result interpretations.
So you buy the signature and the critical-result alert. The explanation your customer reads is yours to build.
You integrate with a CLIA-certified lab, you do not become one
Your partner lab holds the CLIA certificate, and the ordering and display layer you build needs none. That changes only if your product starts performing, interpreting or reporting a test itself.
The lab that runs the assay holds the certificate
CMS’s direct access testing document, version 03/22/2019, says CLIA regulates the laboratories that conduct testing. The individuals who order tests or receive results fall beyond CLIA’s reach, and state laboratory laws may regulate them. We take that to mean your platform’s exposure is in state ordering law.
That split holds whether or not your CLIA-certified laboratory is also a CAP-accredited lab. CLIA governs its lab-developed tests too, since ACLA v. FDA vacated the FDA LDT rule (Arnold & Porter, July 2026).
Reading a home test’s result is the act that needs a certificate
CMS’s over-the-counter home testing FAQ, updated March 4, 2022, requires a certificate once someone other than the person tested interprets or reports a home test’s result. Applied to your product:
- Interpreting or reporting a self-test the consumer ran at home trips that requirement.
- Displaying a result a CLIA lab already reported, including one from a kit the consumer mailed back, stays outside it.
A collection-only site reads nothing and needs no CLIA certificate, but it can still need a state license: Rhode Island licenses collection stations in their own right.
Crossing that line puts you on CMS’s biennial fee schedule
Standing up your own laboratory is a separate project this post doesn’t cover. If your product does interpret or report a result itself, these are the biennial certificate fees CMS currently publishes, from a schedule labeled Updated 2024:
- Certificate of Registration: $123
- CLIA waiver certificate: $248
- PPM certificate: $297
- Certificate of Compliance or Accreditation: $223 to $11,801, priced by annual test volume
Collection is the layer that limits your test menu
Pick the collection route before you pick the test menu. A mailed kit, a walk-in draw and a mobile phlebotomy visit each arrive with a menu already attached.
What a national lab accepts self-collected is a short list
Labcorp’s patient self-collection catalog, accessed September 11, 2026, lists eight kits. There’s no self-collected comprehensive metabolic panel on it, and no self-collected CBC.
Build an at-home lab testing platform on kits alone and that one national lab’s list caps your menu. Kits also put kit fulfillment and logistics on your side of the build, plus any cold chain the menu needs.
A capillary clearance covers a fixed analyte list
Capillary collection is the finger-prick blood test route, and its ceiling is the device clearance. FDA cleared BD’s MiniDraw SST under 510(k) K252378 on April 10, 2026 for 17 analytes. Its indication names a trained healthcare worker as the user rather than a consumer, and its test labeling says the tube isn’t intended for other parameters or analytes.
Under CLIA’s 42 CFR 493.1253, running a cleared test system on a specimen type outside its cleared indications counts as a modification. The lab then has to establish full performance specifications, reference intervals included, before it reports a patient result. So each lab’s accepted-specimen list is short, and a specimen collection kit is only as good as the list at the lab receiving it.
Self-collected blood drops out twice before the lab can run it
In three English regions in 2022, ASSIST, an NHS postal STI self-sampling program, dispatched 610,876 mailed self-sampling kits. Its figures, reported in Sexually Transmitted Infections in 2026, are a proxy for your US consumer kit.
For self-collected blood, measured as a share of orders:
- a sample came back for 36.3% to 65.3%
- a processable sample came back for 22.8% to 57.9%
Of kits returned, 98.5% held at least one processable swab or urine sample, a per-kit rate on a different denominator from the blood figures.
Blood fails at the analyte level too, in a Mayo Clinic proxy for US consumer performance: a single-center comparison of three commercial capillary devices found 17% to 22% of self-collections had insufficient volume, with potassium and bicarbonate clinically discrepant (Journal of Applied Laboratory Medicine, May 2026).
When the menu needs a CBC, someone else has to collect the sample
A CBC isn’t on Labcorp’s self-collection list, so it needs a draw. Quest Diagnostics’ Quest Mobile FAQ, accessed September 11, 2026, says the lab tests bill separately while in-home collection isn’t billed to a health plan or covered by insurance, so your customer pays that fee out of pocket.
The network doing the draw can belong to a consumer testing company: Function Health announced on April 8, 2026 that it had acquired Getlabs, a mobile blood-draw network.
On a walk-in draw, we’d say the trip itself leaks orders. After a virtual visit the draw is a separate trip, and a February 2026 JAMA Network Open study found 77.4% of clinician-ordered tests completed after those visits against 93.7% after in-person ones, a proxy for show rates.
Results arrive as coded observations, and the reference range belongs to the lab
A panel reaches your platform as a structured message with one coded observation per analyte. Your ingestion data model decides whether two of those observations can ever share a chart.
A panel lands as one coded observation per analyte
The result leaves the performing lab’s lab information system (LIS) as an HL7 v2 ORU message or a FHIR DiagnosticReport. In FHIR R4, that DiagnosticReport references the atomic Observation resources for one investigation.
HL7’s V2-to-FHIR mapping of the OBX segment (continuous build, accessed September 11, 2026) shows where each field lands:
| HL7 v2 OBX field | FHIR Observation element |
|---|---|
| OBX-3 Observation Identifier | Observation.code (LOINC) |
| OBX-5 result value, typed by OBX-2 | Observation.value[x] |
| OBX-6 Units | the value’s units |
| OBX-7 References Range | Observation.referenceRange.text |
| OBX-8 Interpretation Codes (abnormal flags) | Observation.interpretation |
| OBX-11 Observation Result Status | Observation.status |
Under this mapping the range arrives as free text in referenceRange.text, so a platform that reads only structured low and high values gets an empty range.
Code against presence and the product breaks on valid data
US Core v8.0.1, dated December 10, 2025, tells the sending system to omit any element it has no data for when the reason is unknown. So a fully conformant lab Observation can arrive with no reference range, no specimen and no interpretation. Treat absence as a normal state, because it is one.
The range and the number both depend on the lab that ran the test
The first cause is regulatory. Under 42 CFR 493.1291(d), the reference interval is the one “as determined by the laboratory performing the tests,” so reference ranges belong to the lab that produced them.
The second is analytical. CDC’s certified total testosterone assay list (updated April 2026) shows what share of 40 samples each method landed within 6.4% of the CDC reference method, per quarter across 2024 to 2025:
- a chemiluminescence immunoassay (Siemens Atellica): 20% to 38%
- an LC-MS/MS method (ARUP): 68% to 88%
The immunoassay stays certified because it passes on average, while most of its individual samples land outside that 6.4% window.
The threshold for a real change comes from within-subject variation
Biomarker trends compare a person with themselves, so the threshold for a real change is the reference change value: the smallest difference between two serial results that can’t be explained by combined analytical and within-subject biological variation (EFLM Biological Variation Database).
ICHCLR’s measurands list (accessed September 11, 2026) rates each measurand’s harmonization status: glucose and HbA1c at Adequate/Maintain, serum albumin at Needed. As we interpret those ratings, results for an Adequate/Maintain measurand compare across labs, and results for a Needed one don’t yet.
Store the performing lab, the method, the unit and the code with every value. A value without them can’t be compared to anything later.
The results experience is the product
In a lab results app or a biomarker tracking app, the hardest call is what earns a flag. The lab supplies the number and its range; the grading and escalation on top are yours to design and support.
That holds for discrete draws, a specimen collected on a date and resulted as a panel. A continuous monitoring stream is a different architecture, covered in our guide to chronic disease management app development.
The range you grade against is yours to choose, and the choice sets your support load
WHOOP’s Advanced Labs support pages (July 30 and August 7, 2026) show what grading against your own population looks like. Its ranges come from where 95% of apparently healthy individuals fall and are tailored to a health-conscious membership. “Optimal” means the top 5 to 10 percent healthiest.
WHOOP says its ranges “may vary slightly from other providers,” including Quest, which ran the assay. WHOOP also publishes a support article on why the two sets of ranges don’t always match.
Narrow your range and the flag stops tracking clinical abnormality. The user holding a lab report that disagrees with your app lands in your support queue.
Healthy adults still get out-of-range results
In a 2016 study of healthy adults tested at two national laboratories, 7.5% to 8.3% of individual results fell outside the reference range. On a wide panel, flags are the normal case.
So the home screen has to pick a lead. Function Health opens on a count of out-of-range markers and Superpower on a score with the markers beneath, according to App Store screenshots read by the affiliate site bloodtestcomparison.com (updated September 2, 2026).
Severity leaves the screen by phone, and the delay you add is regulated
WHOOP’s results support page (July 30, 2026) says a clinician from its partner phones the user when a result crosses certain medical thresholds, with no published threshold list or timeline.
Results also arrive in pieces. In WIRED’s January 2026 test, Oura’s first results came after 24 hours and the doctor-interpreted report with the full set took almost two weeks. Early values sit on screen before the interpretation arrives.
Holding them back is regulated. Under the information blocking rules at 45 CFR part 171, applicable since April 5, 2021, a hold for clinician review stands where there’s:
- advance patient consent to the delay
- a licensed clinician’s judgment that it’s necessary for that patient (45 CFR 171.201)
- a law requiring it (45 CFR 171.103(a))
A blanket hold on every result meets none of them. Your at-home lab test app needs to render a partial panel as a first-class state, with the escalation ladder written into the product as a requirement.
Your AI explanations become a device the moment they interpret instead of display
In lab testing app development, FDA owns the line between displaying a lab result and interpreting it. CLIA decides whether reading a home test the consumer ran needs a certificate; FDA decides whether software that interprets a lab’s reported result is a device. Display is outside the device definition, and interpretation is inside.
Congress drew the line at the word interpret
The statute settles it. 21 USC 360j(o)(1)(D) excludes software for “transferring, storing, converting formats, or displaying clinical laboratory test or other device data and results,” unless the function is “intended to interpret or analyze” them.
For your results portal, that means:
- rendering a panel stays outside the device definition
- telling the user what the panel means is a device function, AI result explanations included
A disclaimer doesn’t move that line.
Founders reach for the clinical decision support exclusion next, but FDA’s guidance on it, dated January 29, 2026, says: “Software functions that support or provide recommendations to patients or caregivers, not HCPs, meet the definition of a device.” Our guide to when health AI needs FDA clearance walks through the full clinical decision support boundary.
FDA has already authorized software that reads a panel and outputs a number
On April 2, 2024, Prenosis took De Novo DEN230036 for Sepsis ImmunoScore and created a new device type at 21 CFR 880.6316. FDA describes it as a software device to aid in the prediction or diagnosis of sepsis. Of its 22 inputs, 15 are clinical laboratory analytes.
That’s what software that reads a panel and outputs a number looks like once it goes through FDA.
The review promise attaches to results, the verification duty to AI output
Function Health’s terms of service, accessed September 11, 2026, say that “you, and not Function, shall be responsible for verifying the accuracy” of its AI chat’s answers, and that use of the service “does not establish a doctor-patient relationship.” Its how-it-works page, accessed the same day, says “clinicians review every result and flag issues.”
A promise like that covers results. The AI layer you’re building is outside its scope, and so is every result interpretation it writes.
Values, ranges, trends, and a nudge stay inside general wellness
FDA’s general wellness policy of January 6, 2026 lets your wellness testing product display values, ranges and trends, and show a notification that professional evaluation may help when an output falls outside wellness ranges, provided that notification:
- names no disease
- doesn’t call the output abnormal
For the policy’s remaining conditions and the rest of the device-status framework, see the FDA clearance guide linked above.
Cash-pay changes which kickback law applies and which states let you mark up
Whether you charge through subscription payments, card-on-file billing or HSA/FSA payments, cash pay changes which rules bind the money side of your platform. It also puts the pricing model and the affiliate compensation plan on your pre-launch list.
The Anti-Kickback Statute follows federal dollars
The Anti-Kickback Statute (42 U.S.C. 1320a-7b) reaches remuneration only for items or services payable under a federal health care program. Here’s where it and EKRA (the other federal kickback law) leave a pure cash-pay platform:
- Anti-Kickback Statute: outside it, by its own terms
- EKRA: its reach is contested, with practitioner commentary on both sides
Flat pay for affiliates is the safe design under either reading.
HIPAA, protected health information (PHI) and every business associate agreement (BAA) stay on your list too; this post leaves that side to our HIPAA-compliant software development guide.
State law decides who bills the consumer
Medicare’s anti-markup rule excludes clinical laboratory tests, so no federal rule caps what you charge above the lab’s price. Founders read that silence as permission.
State law controls who the lab may bill: New York Public Health Law 586 makes it unlawful for a purveyor of clinical laboratory services to bill or receive payment from anyone other than the recipient of the services. Its exception list at 586(2) is closed and doesn’t include a consumer testing platform.
Our reading: where the statute applies, the lab charges the consumer and the platform earns on a separately justified service instead of the markup.
Pay affiliates flat, because EKRA’s safe harbor turns on three variables
EKRA’s employment and contractor safe harbor at 18 U.S.C. 220(b)(2) protects a payment only where it doesn’t vary by:
- the number of individuals referred
- the number of tests or procedures performed
- the amount billed
Per-test and percentage-of-revenue pay falls outside the safe harbor by construction. But the Ninth Circuit’s United States v. Schena decision of July 11, 2025 holds that percentage-based marketing pay doesn’t violate EKRA by itself, and that liability attaches where marketing agents are directed to mislead the people making referrals.
Only flat pay qualifies for the safe harbor, so settle flat retainers for affiliates and sales staff before the compensation plan ships.
The merchant category code decides whether FSA cards work
Whether FSA cards clear at checkout comes down to the merchant category code on your merchant application, so it belongs on the pre-launch list too.
SIGIS, the industry standards body for FSA and HRA card acceptance, sets an industry standard requiring those cards to be declined at merchants that have neither a health care related MCC nor an implemented IIAS. Laboratories sit at MCC 8071.
Before you build a lab testing platform, lock these decisions in order
When you build a lab testing platform, these decisions narrow each other in order, so the order is the checklist:
- Who may lawfully order in your launch states, settled test by test
- For each of the four layers, a direct lab contract or an ordering vendor’s API
- The collection route, which fixes your test menu
- How results and each lab’s reference ranges get coded and stored
- Where an AI explanation stops displaying and starts interpreting
- Cash-pay pricing, markup and how you pay affiliates and sales staff
Who may order and the collection route set constraints every layer above them inherits, so settle both before results design. Our launch checklist is available as a download for your team.
How Topflight Apps can help
The storefront is what you can buy off the shelf. The ordering-and-oversight plumbing behind it and the results experience in front of it are the project, and they’re where your estimate lives.
Topflight Apps helped build MyPaperwork, a HIPAA-compliant consumer STI testing app. It has geolocation-based lab discovery that points users to a nearby certified testing center, in-app ordering and checkout, results delivered in the app, and permission-controlled share links that expire on their own. The product prioritizes verified lab testing over at-home kits.
So the team writing your estimate has already built the consumer-facing half of a lab testing platform. Scoping starts with the rest of the build: the ordering route, the collection method, the results architecture and the boundary an AI explanation runs into. Our guide to telehealth app development covers the ground where that half meets the rest of the clinical product.
A scoping conversation settles three decisions first:
- which layers we build and which you buy
- who signs the order in your launch states
- how specimens get collected for the menu you’re selling
If you’re planning DTC lab testing app development, that’s the conversation to have with us.
Frequently Asked Questions
Do you need a doctor to order your own lab tests?
No federal rule requires one. CLIA needs an order from an authorized person, and state law defines who that is, so the answer changes by state and by test.
Does a direct to consumer lab testing platform need its own CLIA certificate?
Your partner lab holds the certificate. You’d need your own only if your product performs, interprets or reports a test itself.
What does a lab ordering API actually cover?
Junction’s documentation lists order placement, collection coordination, order status and structured results from partner labs, and you check coverage ZIP code by ZIP code.
Can you mark up the price of a lab test you resell?
Federal rules set no cap. In New York the laboratory must bill the consumer directly, so our reading is that you earn on a separate service instead of the markup.
What does a partner lab's CLIA certificate type tell you?
Whether anyone inspects the lab. Compliance and Accreditation applicants start on a Certificate of Registration and typically get surveyed within a year; Waiver and PPM labs aren’t routinely surveyed (CMS, March 2026).
Which states can't you launch in?
That’s a business call layered on state law. Oura’s Health Panels launch on October 21, 2025 excluded Arizona, Hawaii, New Jersey, New York and Rhode Island, citing state-level restrictions.