Two employees. Zero outside capital. $20,000 seed. 14 months. $1.8 billion annual revenue on track.
In April 2026, the NYT published these numbers alongside one name: Matthew Gallagher, 41. He built Medvi, a GLP-1 weight-loss drug telehealth company, from his Los Angeles home.
OpenAI CEO Sam Altman predicted in early 2024 that a one-person, billion-dollar company "would have been unimaginable without AI — and now it will happen." The closest candidate so far turned out to be a healthcare startup.
What is this, exactly?
Medvi is a telehealth middleman for GLP-1 compounded drugs. In its first full calendar year it hit $401M in revenue, 16.2% net margin, 250,000 customers with a 2026 run rate of $1.8B.
Gallagher used ChatGPT, Claude, and Grok for code; Midjourney and Runway for ad creative; ElevenLabs for customer voice tools. Licensed physicians, prescription processing, pharmacy fulfillment, shipping, and compliance were outsourced to CareValidate and OpenLoop Health.
What actually changes?
The core insight is that every business function can be treated as a prompt. Gallagher prompt-ified the entire company.
| Traditional telehealth startup | Medvi model | |
|---|---|---|
| Team | Hundreds to thousands | 2 people + AI agents |
| Infrastructure | Build from scratch | Rent from partners |
| Code | Engineering team | ChatGPT, Claude, Grok |
| Ad creative | Creative team + agency | Midjourney, Runway |
| Net margin | ~5% | 16.2% |
But the success has red flags. Forrester called it regulatory arbitrage: the GLP-1 compounding window was legally open, and AI made execution faster — but timing made it possible.
- HIPAA breach (March 2026)
Changing one URL digit exposed another patient's full medical record. 250,000 customers had this vulnerability. Classic IDOR. Patched in 90 minutes, but breach notifications were not sent. - FDA warning letter (February 20, 2026)
Medvi's site claimed products had "the same active ingredient as Wegovy" — implying FDA approval that compounded drugs don't have. Failure to respond could lead to seizure or injunction. - Fake doctor ads (April 2026)
Business Insider found 5,000+ Meta ads run by apparent AI-generated fake doctor accounts.
Not replicable for everyone
Medvi's success depended on a specific regulatory window that is actively narrowing. By 2026, the FDA had issued 30 warning letters to telehealth sites marketing compounded GLP-1s. This is "timing + AI" — not just AI.
How to apply this: 5 layers
- Rent infrastructure, don't build it
Own only the customer relationship. Outsource everything else to specialized partners. - Default to AI for every business function
Website copy, ad creative, code, CS scripts — start with AI, validate before hiring humans. - Connect systems with AI agents
Build automation loops: customer intake → screening → routing → fulfillment → CS — no human handoffs. - Calculate margin structure first
Ask: "Does this work with zero employees?" If yes, scale. Medvi's model proves it's possible. - Map regulatory risk on day one
Get compliance counsel in month one. "We'll deal with it later" is the most dangerous assumption in regulated markets.
Gallagher's own admission on defensibility
"Medvi holds no proprietary technology, no licensed physician network, no pharmacy infrastructure, and no exclusive supplier relationships. Any operator with marketing fluency and a CareValidate or OpenLoop account can replicate the model."
