Two People, $1.8B: What Medvi's Legal Troubles Tell Solo Founders

“Two people. $1.8 billion.”

When NYT published that number, even I felt it. But knowing what was piling up behind that story changes the nature of the feeling entirely.

The company is Medvi, an LA-based telehealth operator running GLP-1 (obesity treatment medication) prescriptions through AI. Matthew Gallagher founded it with his brother Elliot — two employees, total. NYT reporter Erin Griffith broke the story on April 2, 2026: 2025 revenue of $401M, on pace for $1.8B in 2026. Starting capital: $20K. Time to launch: two months. Coding, marketing, customer service — all handled by AI.

That’s the fact layer. And as the largest real-world example of what I called the “AI Solo Unicorn” phenomenon back in Round 32, Medvi was absolutely the headliner.

The problem is the shadow that had been building before, during, and after that glowing NYT story — and never stopped growing.

Class action lawsuits. FTC investigation requests. FDA warning letters. Accusations of 800+ fake-doctor Facebook ads. Techdirt ran a piece headlined “NYT Got Played by a Fraudulent Telehealth Company.”

After reading this article, you’ll be able to do three things:

• Separate which parts of the “two people, $1.8B” story are real from which are shadow
• Identify concrete risks in your own business across three domains: affiliates, outsourcing, and marketing claims
• Choose one boundary line you can start implementing today in 30 minutes to an hour

I wrote yesterday about the limits of going solo with AI — the three things AI can’t do for you, and the three design paths beyond them. Today’s Medvi update is a case study proving those limits from the outside. The FTC, the FDA, and the class action plaintiffs are all pointing at the same place: “This part is your responsibility.”

Before you steal the myth, steal the insurance against the shadow.

Sorting What Was True in NYT’s “$1.8B / 2 People” Story

First, let’s establish what’s verifiable. Getting sloppy here would compromise everything that follows.

Four core numbers from Erin Griffith’s April 2, 2026 NYT piece: 2025 revenue of $401M, projected $1.8B pace in 2026, two full-time employees (founder Matthew Gallagher and brother Elliot), launched on $20K in two months. NYT states it independently verified revenue and profit figures.

The AI stack is specific. Matthew uses multiple chat-based AIs — ChatGPT, Claude, Grok — for different tasks: website building, autonomous agent construction, system integration. Voice AI: ElevenLabs (in pilot). Image and video generation: Midjourney and Runway. From ad creatives to customer-facing media, all generative AI.

The business structure: radical outsourcing of everything non-core. Physicians, pharmacy, compliance, and delivery are handled by external platforms — CareValidate and OpenLoop Health. Medvi itself retains only three things: marketing, customer experience, and technology decision-making.

That’s the verifiable part. NYT had reporters on this, and the financials were reviewed. There’s no reason right now to doubt the “$1.8B, 2 people” numbers themselves.

What happened next is where the story gets complicated. The “success myth” NYT wanted to tell had a shadow underneath it — one that had been building before the story ran, and kept building after.

Techdirt flagged it. Yahoo Finance, Moneywise, and MSN ran follow-up pieces. AOL reported on the alleged 800+ fake doctor ad accounts. These weren’t revelations that came after the NYT piece. They were things that had already accumulated before it ran.

The $1.8B number can be real and the methods still be off-limits to replicate. That distinction is exactly where solo founders get hurt.

Three Categories of Shadow Building in the Same Period

Let’s put the timeline around the April 2 NYT story in order.

Earliest: fall 2025. The National Consumers League (NCL), alongside other organizations, filed a request with the FTC to investigate Medvi and five other telehealth companies. NCL’s Food, Nutrition, and Obesity Director Nancy Glick pointed to specific ad claims: “trusted by experts” and “doctor-approved” allegedly misled consumers about the safety review status of compounded medications.

Next: FDA warning letters, issued before the NYT story ran. Confirmed by a 2026 fact-check from MedicalFoundation of NC and Drug Discovery and Development. The Drug Discovery and Development headline put it plainly: the FDA had already warned a company claiming to be the fastest-growing in history — before NYT published anything.

Then, March 20, 2026 — thirteen days before NYT’s story — a class action lawsuit is filed in California. More than 100,000 plaintiffs. The central claim: Medvi profited from affiliate spam, with subject lines like “maybe the easiest way to start Ozempic” driving traffic to Medvi landing pages. The case invokes California’s anti-spam law.

April 2: NYT story publishes. April 7: Techdirt publishes its rebuttal with an unsparing headline.

After that: AOL and Moneywise report on 800+ Facebook ads allegedly featuring fabricated doctors — names and headshots of physicians who didn’t exist.

Gallagher’s position: “The affiliates created those ads without my approval.” He told NYT that. Whether that defense holds in court is precisely what’s being litigated.

The sequence: FTC investigation request (fall 2025), FDA warning (before April 2), class action (March 20), NYT story (April 2), Techdirt rebuttal (April 7), ongoing reporting. A $1.8B success story with legal and regulatory arrows coming in from every direction.

I’m not here to declare Medvi a fraud. No judicial ruling has been issued. These are still allegations, and Gallagher has denied them. But if you’re a solo founder thinking about replicating this model, copying only the success while ignoring the shadow puts you in the same place they’re in.

Separating “What AI Can Build” From “What Outsourcing Can’t Transfer”

The first thing to extract from the Medvi situation:

AI can build a lot. Code, marketing copy, analytics reports, customer service templates. That’s real, and Medvi ran on exactly that. I said the same thing in yesterday’s solo AI limits piece — and I stand by it.

The trap is assuming that what AI can’t build can simply be outsourced away. Medical judgment, compliance, ethical decision-making, long-term customer relationships — these can be delegated to external doctors, lawyers, compliance specialists. Medvi delegated them to CareValidate and OpenLoop Health.

But there’s a trap in that structure.

Outsourcing doesn’t make the responsibility disappear.

Medvi’s ads said “doctor-approved.” The external doctors may have existed — but Medvi’s own marketing made the claim. “The affiliates did it without our permission” doesn’t hold when you’re the one who contracted with those affiliates. The class action defendant isn’t CareValidate — it’s Medvi.

Let me make this concrete with my own work. Say I’m consulting on social media marketing for a client, and I subcontract the ad management to an outside agency. The agency creates misleading copy and it blows up. Who does the client hold responsible? Their contract is with me. “The agency did it” is a conversation between me and the agency — not a defense I can give the client.

For solo founders trying to replicate Medvi, this is the decisive line: can you draw it, or not?

AI and outsourcing together can get you closer to “two people, $1.8B.” They can also expose you to that exact scale of legal liability. Conflating “I can outsource the execution” with “I can outsource the responsibility” is where the trouble starts.

Boundary Line 1: Treat Affiliate Traffic as Your Own Editorial Responsibility

The first concrete boundary: affiliate relationship design.

The core of the Medvi class action is affiliate spam — partner email distributors sending mass emails with subject lines like “maybe the easiest way to start Ozempic,” all pointing to Medvi landing pages. California’s anti-spam law puts that liability on the advertiser.

Common patterns where solo founders walk into the same trap:

Running an affiliate program through an ASP (affiliate service provider) with dozens of partner bloggers on commission. Advertisers rarely check what partner bloggers write about their products. “I didn’t write those ads myself” is the logic, but the legal responsibility rests on the advertiser.

Paying influencers on Twitter/X to promote a product. If an influencer spontaneously writes “3x the results,” and there’s no review process for their copy, you as the advertiser may be held liable for the misleading claim.

Placing referral links from partner sites on your own website or newsletter. Whether you have supervisory responsibility for the partner’s sales page — and what that means legally — is ambiguous without a clear contract.

Three actions you can take today:

First, inventory every active affiliate contract. Read the actual contract language — email threads count. Find the answer to “who bears final responsibility for ad copy?” If the contract doesn’t say, negotiate to make it say.

Second, build a system for reviewing partner ad copy once a month with your own eyes. Notion, a spreadsheet, anything. Three columns: URL, date reviewed, reviewer. That’s enough. Make it visible that you treat this as your editorial responsibility.

Third, write a one-page guideline for what affiliate partners can say about your brand. “Trusted by experts,” “doctor-approved,” “proven to work” — any claim that can’t be verified on demand goes on the prohibited list. Having this guideline vs. not having it is the difference between being able to defend yourself in litigation and not.

Skipping this because it’s a pain puts you in the same position as the Medvi class action defendant. The more revenue your affiliates generate, the more essential this audit becomes.

Boundary Line 2: Write “Responsibility Stays Here” Into the Contract When You Outsource Core Functions

The second boundary: core outsourcing design.

Medvi’s structure is radical outsourcing of the core. Physician prescribing judgment to CareValidate. Pharmacy and delivery to OpenLoop Health. Medvi itself keeps only the surface: marketing, site, and CS.

I’m not saying this structure is wrong. For a solo founder, this outsourcing model is the core technology behind “two people, $1.8B.” The problem is the moment you outsource and start acting like you’ve handed off the responsibility too.

Medvi marketed itself as “doctor-approved.” That means Medvi took on the obligation to confirm and document what approval process the outsourced doctors actually ran. “The external party handles it” doesn’t fly. The FDA warning letter and the NCL’s FTC request both exploit exactly that gap.

Common patterns for solo founders:

Running an online school that advertises “taught by working professionals” with external instructors. Are you verifying and recording each instructor’s credentials and current role under your own responsibility? When an instructor exaggerates their background, are you ready to absorb the liability?

Running a SaaS where payments go through Stripe, email through SendGrid, and data through AWS. When a user says “you leaked my personal information,” the range where you can blame Stripe or AWS is extremely narrow.

The implementation of this boundary starts with adding a single “responsibility allocation clause” to your contracts.

First, itemize the scope of each outsourced function in plain terms. Explicitly document who is responsible for “displaying doctor approval,” “verifying ad copy,” and “handling personal data.”

Second, set up a monthly spot-audit of vendor performance. Screenshots, meeting notes, logs — any of these. Having them vs. not having them changes your ability to defend yourself when something goes wrong.

Third, explicitly document the line “from here, this is my responsibility” — in your own documents, since you’re the only one in the company. “Ad copy requires my final approval.” “Major customer disputes, I handle directly.” Make the lines that outsourcing can’t erase into words.

The “two people, $1.8B” structure requires core outsourcing to work. Which means: the vaguer the responsibility design of your core outsourcing, the more the risk scales with the revenue.

Boundary Line 3: Build Proof for Marketing Claims Before You Scale

The third boundary: verifiability of marketing language.

“Trusted by experts” and “doctor-approved” — the expressions NCL flagged — are exactly the type of language that becomes the primary target of lawsuits and regulatory action. “What experts?” “Which doctor approved it, and using what process?” If you can’t answer those questions on demand, you’re exposed to a false advertising claim.

For solo founders in Japan, the domestic equivalents: “Customer Satisfaction No. 1,” “industry-first,” “overwhelming support” — if these can’t be backed up with survey data that aligns with the claim, they’re potential violations of Japan’s Act Against Unjustifiable Premiums and Misleading Representations. In cosmetics or health products, the same claims can intersect with pharmaceutical law.

By “verifiability,” I mean: if a regulator or competitor requests documentation, can you pull it within 24 hours? The reason Medvi is struggling in litigation is that the court is asking “who are the experts who trust you?” — and whether the company can actually produce documentation.

What solo founders can implement today is simple.

First, create a “claim source file” — one document in Notion or Google Docs. List every authority-building claim on your product pages and landing pages. “Customer testimonials,” “No. 1,” “doctor-supervised,” “expert-recommended,” “industry-exclusive” — write them all out.

Second, attach corresponding source documentation to each claim. Survey result PDFs, research firm reports, supervisor credentials and sign-off, industry statistics with sources. Add a monthly link-rot check.

Third, immediately delete any claim that can’t be documented. Or replace it with a conditional statement: “Based on internal survey, as of [year/month].” This work takes one day. If it takes longer, don’t run the ads until it’s done.

This alone substantially reduces the risk that Medvi’s lawsuit targets. And doing this while you’re small is exactly the point. The larger the scale without this foundation, the faster the litigation risk compounds.

What Medvi likely didn’t do before scaling: build this source file before the growth came.

Reading Medvi’s Shadow as a Design Case Study

Stopping at “so Medvi was shady after all” wastes the lesson.

No judicial ruling has been issued. The class action and FTC request are still at the allegations stage. Gallagher has denied them. I’m not declaring Medvi a fraud.

But solo founders trying to replicate “two people, $1.8B” — and there will be more of them. Anthropic CEO Dario Amodei’s claim is still circulating in tech media: “There’s a 70–80% chance a one-person $1B company exists by end of 2026.” I mapped that landscape in Round 32, and I built an entry map of solo entrepreneurship from Forbes AI 50 afterward.

That’s exactly the environment where “seeing myth and shadow together” becomes essential going into the second half of 2026.

To summarize.

The “facts” NYT established: Medvi’s $401M-to-$1.8B revenue from two people, its AI-powered operation, and its core-outsourcing structure. Still worth referencing.

What NYT “couldn’t fully cover”: the FTC, FDA, class action, and fake-ad accusations that had been accumulating throughout that same growth period. The volume and variety were too substantial to file under “successful people get sued — it happens.”

The practical lesson for solo founders: building immunity to the shadow is more valuable than stealing the myth.

Boundary line 1: treat affiliate traffic as your editorial responsibility. Contract audit, monthly copy review, prohibited expression guideline. You can start in 30 minutes today.

Boundary line 2: outsourcing core functions doesn’t transfer the responsibility. Responsibility allocation clause in contracts, monthly spot audit, written “this is my responsibility” line. You can have the skeleton built in one hour today.

Boundary line 3: build proof for marketing claims before you scale. Claim source file, documentation links, immediate deletion of unsupportable language. You can complete this in one day.

Whether you’re aiming for “two people, $1.8B” is a personal decision. Many of my readers want something smaller, more human-scaled, at a pace that’s sustainable for them. That’s exactly why I want them to read Medvi’s myth and shadow not as someone else’s story — but as a design case study for their own business.

Honest take: these three boundary lines are unglamorous. Reading them won’t give you an “incredible” feeling. But whether you do this or not determines the safety of your business three years from now, in a way that’s decisive.

I wrote yesterday about the domains AI can’t be left alone with. Today’s Medvi update gives those domains a concrete face — as external pressure. The FDA, the FTC, the class action plaintiffs are all saying: “This part is your responsibility.”

Steal the insurance against the shadow before you steal the myth. That’s my proposal today.

If you’re not sure where to start, begin with Boundary Line 3 — the claim source file. It’s the fastest to implement and takes the biggest risk off the table. Make one page today, and pull every claim from your current landing pages and product pages into it.

I’ll be reviewing my own site today. I wrote this, which means I move first.