I reviewed a men's-health clinic chain recently. Roughly 75 physical clinics, a clean WordPress build, fast, good content across the treatment pages, a page for every location. In a browser it looked like a real, established medical brand. Then I looked at it the way Google's health system and an AI answer engine actually look at it, and the one thing that should have been its biggest advantage, all those physical clinics, was nearly invisible in the markup.
That gap is now its own check in the Mega Analyzer. When it detects a men's-health, testosterone-replacement (TRT), or hormone-optimization clinic or telehealth service (signals like "testosterone replacement," "low T," "TRT," "HRT," "andropause," ED or weight-loss/GLP-1 in a clinic context, or MedicalClinic / MedicalOrganization schema), it runs a YMYL-Health readiness pass. Health is the most trust-sensitive category on the web, "your money or your life," so this check is as much about credibility and compliance as it is about schema. Here is what it looks at and why each one decides whether a clinic gets found and trusted.
The multi-location trap: every clinic sharing one identity
The clinic I reviewed did the hard part right. Every location page carried a MedicalBusiness node with a real phone number and map coordinates. But two defects quietly undid all of it.
First, the PostalAddress on each clinic was empty, the streetAddress, addressLocality, addressRegion, and postalCode fields were all blank strings. Map coordinates alone are not enough; the human-readable name-address-phone is what a search engine and an AI answer reconcile to a real place. Second, and worse, all of the locations shared one identical @id rooted at the site origin (think <site>/#medicalbusiness). To a knowledge graph, that means every clinic in the chain collapses into a single ambiguous entity. Seventy-five clinics, one identity.
For a brand whose entire structural advantage over telehealth rivals is that it has real clinics you can walk into, that is the most expensive thing on the page, and it is invisible to the owner because the locations look fine in a browser. So the check flags both directly: an empty PostalAddress, and a clinic @id that is rooted at the site origin instead of being page-unique. The fix is to give every location a page-unique @id (<this-location-url>#clinic), a complete address, hours, geo, areaServed, and that clinic's own Google Business Profile in sameAs.
Type the brand as a medical entity, not a generic Organization
The top-level brand node was typed as a plain Organization with zero sameAs links and no telephone. For a YMYL-Health business that is a miss twice over: the generic type does not tell Google's health system you are a clinical entity, and zero sameAs means AI answer engines cannot reconcile the brand across Facebook, Instagram, YouTube, and the Google Business Profile into one established medical organization. The check wants ["MedicalClinic","MedicalOrganization"] with a medicalSpecialty, a telephone, and a full sameAs array. Two of the competitors I benchmarked already type their brand as a medical organization; shipping a bare Organization with no social proof is an entity-dark signal in a category where trust is everything.
E-E-A-T: who wrote this, and is it a real clinician?
Here is the check that matters most for health content and the one most clinics fail. The site had Person and Article schema on its medical articles, which sounds good, until you read the author's name: a CMS placeholder like "Content," not a named, credentialed clinician.
Google's guidance for "your money or your life" health pages is explicit that expertise and trust come from identifiable, credentialed people. The check flags a placeholder author on a medical page, and the absence of a reviewedBy / lastReviewed medical-reviewer block. The fix is real and free: put a named clinician on the content (Person with hasCredential MD/DO/PA-C/NP), add a "Medically reviewed by [Clinician, credential] on [date]" byline, and declare it in schema. A clinic is full of exactly the credentialed people who should be authoring and reviewing this; the trust signal is sitting unused.
FAQPage on the questions patients actually ask
The clinic had a low-testosterone FAQ page: about 1,800 words, dozens of questions, written as pure question-and-answer. It had no FAQPage schema. That is the highest-leverage answer-engine win available, because "is TRT safe," "how do I qualify for TRT," "does insurance cover testosterone," and "GLP-1 for weight loss" are exactly the questions AI Overviews and ChatGPT lift answers for, and almost no men's-health competitor ships the markup. The check flags a symptom, qualify, or FAQ page that reads as Q&A but has no FAQPage JSON-LD. Keep the answers factual and clinician-reviewed, because in this category the machine-readable answer carries the same liability as the visible copy.
Reviews, handled under FTC and HIPAA
A 75-clinic chain has thousands of patient reviews, and not one of them was machine-readable. The check flags the absence of AggregateRating / Review schema where a clinic clearly has reviews, but it adds two compliance guardrails most marketers miss. Reviews must be genuine and non-incentivized under the FTC's 2024 consumer-review rule (16 CFR Part 465), and, uniquely to health, a patient testimonial reveals that the person received treatment, which is protected health information. You need HIPAA-valid written authorization before publishing it. The fix order: drive reviews through each clinic's Google Business Profile, get authorization for any testimonial, then emit AggregateRating with the real count.
The check AI answer engines made necessary: can the bots even read you?
The clinic sat behind an aggressive bot challenge that returned a block page to any automated request. Good for stopping scrapers, but the same edge protection challenges the AI citation crawlers, GPTBot, ClaudeBot, PerplexityBot, and Google-Extended, which fetch from datacenter IPs and identify as bots. If they are blocked, the clinic is invisible to AI answers for "TRT clinic near me" and "is TRT safe" exactly as those surfaces become the place people start. The check flags a managed bot challenge on the page and the absence of an llms.txt. The move is to allow the named AI crawlers through (verify with each user-agent), keep human bot protection on, publish an llms.txt, and make the in-clinic, in-person-evaluation model explicit, because that is a genuine differentiator worth being cited for.
The controlled-substance and FDA-indication guardrail
This is the layer that protects the clinic, and it is specific to this vertical. Testosterone is a Schedule III controlled substance, and it is FDA-approved only for classical hypogonadism, not for age-related "low T" or anti-aging. So the check looks for three things in the copy: an "FDA-approved" claim sitting next to testosterone (the indication has to be accurate and bounded), anti-aging or "reverse aging" framing of testosterone (that is off-label promotion and a recognized enforcement risk), and online or telehealth testosterone-prescribing language (because the Ryan Haight Act generally requires an in-person evaluation to prescribe a controlled substance). When a clinic's model is genuinely in-clinic, that in-person evaluation is a compliance and trust advantage over "get testosterone online" rivals, and the check rewards saying so. It applies the same substantiation logic to GLP-1 weight-loss claims, where both FTC substantiation and compounded-drug sourcing are under active scrutiny.
The quieter ones
The check also covers MedicalWebPage and MedicalProcedure typing on treatment pages (so an AI answer can map "how does TRT work" to your clinical page), a Google Business Profile link per location, a HIPAA note on any intake or booking form that collects health information (no marketing pixels on pages that submit health data, an issue that has drawn real enforcement), and an hreflang / Spanish-language signal, because the U.S. Hispanic male demographic is a large and underserved TRT audience and a low-competition lane.
How to use it
Run your clinic's site through the Mega Analyzer. If it detects a men's-health or TRT clinic you will get the readiness card with a copy-ready fix prompt that walks through everything in order, the medical brand entity, the per-clinic identity, the credentialed author, FAQPage, reviews, AI-crawler access, and the compliance wording, with the reminder to route every medical-efficacy, indication, and testimonial line through clinical and legal review first. Validate the schema with the Schema Validator.
If you run a clinic and this list looks like an agency project, it is not. It is a block of JSON-LD per location, a real clinician's name on the content, a free Google Business Profile per clinic, and honest copy a compliance officer can sign. That do-it-with-free-tools approach is the whole thesis of my book The $20 Dollar Agency.
Fact-check notes and sources
- schema.org
MedicalClinic,MedicalOrganization,MedicalWebPage,MedicalProcedure,reviewedBy/lastReviewed: schema.org/MedicalClinic - Google guidance on E-E-A-T and "Your Money or Your Life" pages: Google Search Quality Rater Guidelines and google.com/search/howsearchworks
- FDA on testosterone indication (approved for hypogonadism, not age-related low T): fda.gov testosterone safety communication
- Ryan Haight Online Pharmacy Consumer Protection Act + DEA telemedicine of controlled substances: deadiversion.usdoj.gov and 21 U.S.C. 829(e)
- FTC Rule on Consumer Reviews and Testimonials, 16 CFR Part 465 (2024): ftc.gov
- HHS HIPAA guidance on online tracking technologies and PHI: hhs.gov HIPAA online tracking
Related reading
- The Mega Analyzer now reads handyman and home-services sites: getting a local trade found by 'near me' and AI
- The Mega Analyzer's RIA / wealth-management readiness check and the SEC Marketing Rule
- Cross-platform brand presence: the sameAs breadth that makes a business citable
This post is informational, not medical or legal advice. Health-advertising, controlled-substance, telehealth-licensure, and HIPAA rules are strict and vary by state; confirm the rules and get clinical and legal sign-off before publishing. Any clinic reviewed was anonymized as "a site I was asked to review."
