Lawsuits. Court records show MEDVi, LLC as a defendant in three federal cases, all in the US District Court for the Central District of California. Kymberly Starling v. Medvi LLC et al (2:25-cv-11282) was filed on 24 November 2025 under the Telephone Consumer Protection Act over marketing text messages; MEDVi filed an answer on 9 February 2026, the plaintiff filed a notice of settlement on 8 April 2026 and the case was dismissed with prejudice on 6 May 2026 (UniCourt docket, read 28 October 2026). Dallas James et al v. Medvi LLC (8:26-cv-00641) was filed on 20 March 2026 as a class action under California Business and Professions Code section 17529.5, the state anti-spam law; the complaint alleges that affiliate marketers sent emails with falsified headers and subject lines routing readers to MEDVi, seeks $1,000 per email, and pleads a class of at least 100,000 people (Law360 case header; Drug Discovery and Development, 4 April 2026). The New York Times described that case as pending in an editor's note added around 10 April 2026; we could read no later docket entry. A third class action, E.P. et al v. Medvi, LLC (2:26-cv-03796), was docketed on 9 April 2026 (Law360 case header); the complaint was not available to us and its claims are not described here. An earlier TCPA case in the Southern District of Florida, Siuksta v. MEDVi, LLC (1:25-cv-22185, 2025), was voluntarily dismissed, according to Drug Discovery and Development. None of these is a finding against MEDVi: one settled, one was withdrawn, and two were open on the last date we could read.
A lawsuit often listed next to MEDVi's name is one it is not a party to. A November 2025 complaint in the US District Court for the District of Delaware names OpenLoop Health and the compounding pharmacy Triad Rx, not MEDVi, and alleges that compounded oral tirzepatide tablets, which the plaintiff says were bought through MEDVi, are not absorbed (Drug Discovery and Development, 4 April 2026). Compounded GLP-1 medicines are not FDA approved, and we make no statement about whether any product works.
Data breach. There is no breach of MEDVi's own systems on the public record. The breach attached to MEDVi in search results is at OpenLoop Health, Inc. of Des Moines, Iowa, which MEDVi names on its own pages as its prescriber network. OpenLoop's notification letter, filed with the Montana Department of Justice and dated 17 March 2026, states that on 7 January 2026 it learned an unauthorised third party had accessed its systems and removed information, that the access ran from 7 to 8 January 2026, and that the incident did not involve electronic health records, Social Security numbers or financial account information; it offers a year of identity monitoring. Letters filed with the California and Texas attorneys general list names, addresses, email addresses, dates of birth and medical information as the data involved; the Texas Attorney General listing of 18 March 2026 gives 68,160 Texas residents, and the US Department of Health and Human Services breach portal lists 716,000 individuals (HIPAA Journal, 11 May 2026; SecurityWeek). A threat actor claimed 1.6 million patients; OpenLoop has not confirmed that figure (Iowa Capital Dispatch, 19 February 2026). A class action over the breach was filed against OpenLoop in the Southern District of Iowa; MEDVi is not a party. OpenLoop's letter does not name the companies whose patients were affected, no notice issued in MEDVi's name was found, and neither company has stated whether MEDVi customers' data was included. If you were a MEDVi patient before January 2026 and want to know, ask MEDVi and OpenLoop directly.
The $1.8 billion story. On 2 April 2026 the New York Times published a profile of MEDVi and its founder, Matthew Gallagher, presenting it as a two-person company built with AI tools and on track for $1.8 billion in sales in 2026. The figure is projected revenue, not a valuation; the company has raised no outside funding and has no official valuation, and 2025 sales were reported as $401 million (Moneywise, 7 April 2026; Techdirt quoting the Times). Around 10 April 2026 the Times added an editor's note saying the piece should have included the FDA warning letter and the pending California anti-spam class action (Futurism, 10 April 2026). The story is about the company's marketing and revenue; it says nothing about the medicines, which are the compounded GLP-1 products described elsewhere on this page.
What MEDVi has said. In a statement reported by Futurism on 9 April 2026, Mr Gallagher said "My company MEDVi has never received a letter from the FDA", that the letter named the domain medvi.io rather than medvi.org and was "directed at an affiliate marketing agency", that MEDVi had "only recently become aware of what appear to be advertisements featuring potentially AI-generated medical practitioners", and that it had "immediately reached out to the affiliate and required them to remove the materials". The FDA's letter is addressed to MEDVi, LLC dba MEDVi at 131 Continental Dr., Newark, Delaware, the postal address MEDVi publishes, and the FDA page showed no close-out on 18 October 2026. In the Starling case MEDVi filed an answer and then settled. We found no public statement from MEDVi on the James or E.P. cases or on the OpenLoop breach.
What we could not verify, and have left out: the contents of the E.P. complaint, any state-court case, any figure for how many MEDVi customers were in the OpenLoop breach, and the outcome of the James case after April 2026. Court docket sites refused automated reads on 28 October 2026, so the docket facts above come from UniCourt and Law360 case headers rather than PACER itself.
Sources: Starling v. Medvi LLC docket (UniCourt) (checked 28 October 2026); James v. Medvi LLC, 8:26-cv-00641 (Law360) (checked 28 October 2026); E.P. v. Medvi, LLC, 2:26-cv-03796 (Law360) (checked 28 October 2026); Drug Discovery and Development, 4 April 2026 (checked 28 October 2026); OpenLoop Health notification letter, Montana Department of Justice (checked 28 October 2026); HIPAA Journal on the OpenLoop breach, 11 May 2026 (checked 28 October 2026); SecurityWeek on the OpenLoop breach (checked 28 October 2026); Iowa Capital Dispatch, 19 February 2026 (checked 28 October 2026); Moneywise via AOL, 7 April 2026 (checked 28 October 2026); Futurism, MEDVi statement, 9 April 2026 (checked 28 October 2026); Futurism, New York Times editor's note, 10 April 2026 (checked 28 October 2026).