FDA enforcement screening

On September 1, 2026 this page published “0 matches across 52 companies”. That was wrong.

The matcher required every token of a company name to appear in a letter's entity name. FDA names these companies as 'Legal Entity Inc. dba Trading Name', so a register entry called 'Eden' never matched a letter naming 'Eden Health International Inc. dba Eden'. The screen reported a clean result for nine companies that have letters. A matcher whose rule is wrong returns the same clean answer forever, which is why a null needs a control that would have caught this and did not.

The error ran in the worst direction available: it gave a clean result to companies that hold letters. It is left on this page rather than deleted, because the point of a register is that its mistakes are visible with their dates.

Screened September 2, 2026: all 52 companies in this register against the full FDA warning-letter index, then holding 3,677 letters.

9 confirmed warning letters across 9 companies. Every one was verified by reading the letter and matching its entity and address, not by the name alone.

Each candidate was confirmed by reading the letter and matching the entity and the address against the business we record, corroborated from each company’s own terms or footer. All 9 are confirmed. Two do not attribute cleanly and say so on their own records.

• Alan Health — FDA wrote to Alan Health Technologies Inc. dba Alan on February 20, 2026, reviewing www.alanmeds.com. Letter
• Bliv — FDA wrote to Bliv Wellness LLC dba Bliv on February 20, 2026, reviewing www.joinbliv.com. Letter
• Eden — FDA wrote to Eden Health International Inc. dba Eden on June 8, 2026, reviewing www.tryeden.com. Letter
• GoodGirlRx — FDA wrote to Good Girl LLC dba GoodGirlRX on February 20, 2026, reviewing goodgirlrx.com. Letter
• Hims — FDA wrote to Hims & Hers Health, Inc. dba Hers on September 9, 2025, reviewing www.forhers.com. The letter is addressed to the parent company but reviews forhers.com. It does not review or cite hims.com. Saying "Hims received a warning letter about hims.com" would be false. Letter
• Maximus — FDA wrote to Maximus Health, Inc. dba Maximus on June 8, 2026, reviewing www.maximustribe.com. Letter
• Measured — FDA wrote to Better Health Labs, Inc. dba Measured on February 20, 2026, reviewing trymeasured.com. Letter
• WeightCare — FDA wrote to Weightless Medical LLC dba WeightCare on February 20, 2026, reviewing joinweightcare.com. The letter gives no street address, only "United States", and the company does not publish the entity "Weightless Medical LLC" anywhere on its own site. The tie is the domain and the contact address, which is a solid tie to the business but leaves the corporate identity resting on FDA's statement alone. Letter
• Zealthy — FDA wrote to FitRX, LLC dba Zealthy on September 9, 2025, reviewing www.getzealthy.com. Letter

That gap between a name and an attribution is not bureaucratic. A network of sites related to this one has previously published fabricated allegations by matching a resembling name, and this screen’s first run surfaced “Eden” matching inside “GN Tobacco Sweden AB”. A Swedish tobacco manufacturer is not a telehealth company. In the other direction, Zealthy’s own footer says “Zealthy, Inc.” while its letter and terms both say “FitRX, LLC dba Zealthy” — a name-only check would have wrongly rejected a real match.

A screen that is quietly broken clears every company and looks identical to one that genuinely found nothing. FDA’s own search endpoint has exactly that failure: it accepts a search term, ignores it, and returns the entire unfiltered index with a success code.

So the screen downloads the whole index and matches locally, and it runs a control first: 2 companies known to hold letters are searched for, and the run aborts unless all are found. On the current run, 2 of 2 were found.

The fetcher carries its own control too. Nine letter URLs returned HTTP 200 at about 40 KB each, while a deliberately fake letter URL and the index returned HTTP 404 at exactly 14,501 bytes. The fetcher distinguishes a real page from a missing one, so no verdict here rests on a false absence.

Neither control caught the matching error above, because the fetch was fine and the matching rule was wrong. A control proves the instrument reads; it does not prove the ruler is right. The rule now matches on the trading name after “dba” as well as the leading entity name, which is how these letters actually name a telehealth company.

When a candidate is confirmed it becomes a dated note on that company’s record and appears in the change log. It does not remove the entry, does not change the entry’s status, and is not treated as a verdict on the company or its care. Readers are entitled to the fact; deciding what it means is theirs.

Monthly, alongside price re-verification, and the run date on this page changes when it does. Method and cadence sit with how entries are recorded.