Bolt Pharmacy

Two entities, one group. Bolt Healthcare Ltd holds the GPhC pharmacy registration (9013085, superintendent Phuong Nguyen, GPhC 2204151). AIOS Technology Ltd holds the CQC registration for prescribing (1-25516432019, "Independent doctor service", registered 23 January 2026, not yet inspected). AIOS owns 75%+ of the pharmacy.

Founded September 2023 by Saim Dalvi and Maryam Mahmud. Both resigned as directors and ceased as PSCs on 2 April 2025, the day AIOS Technology Ltd took 75%+ ownership and Richard Cartwright became sole director. AIOS Technology's own controlling shareholder since December 2024 is Aios Inc, a Delaware corporation in San Francisco: Y Combinator W20, previously known as Fella Health, founded by Richie Cartwright. The Android package name is com.aios.boltpharmacy.

Bolt's site states that AIOS "is independent of Bolt Healthcare Ltd". That is true in the narrow regulatory sense and misleading in the commercial one: AIOS owns the pharmacy, both sit under the same US parent, and Phuong Nguyen is simultaneously Bolt's superintendent pharmacist and AIOS's CQC nominated individual.

Mounjaro £169 to £319 one-off by dose, £149 to £299 on subscription. Wegovy £119 to £259 one-off, reordering at £99 to £239, with a £59 first month at the entry dose. Bolt undercuts Juniper at every rung, and by 40% at the Wegovy entry dose, which is where acquisition happens. But Bolt’s ladder rises 101% from bottom to top against Juniper’s 70%. A means-tested “pay-as-you-can” tier exists for benefit claimants.

Undisclosed. The US parent's funding is not public.

Correction. This page previously recorded roughly 250 Trustpilot reviews. It is now 5,984 at 4.5, with 566 of them one-star. Whatever else is true, the growth is real. Group revenue claims are self-reported and mutually inconsistent: the Y Combinator profile says “>$100M/yr revenue” and “>50k customers”, while a Bolt recruitment advert says “$400M ARR” and “150k UK active GLP-1 patients”. No filed UK document yet corroborates any of it. AIOS Technology Ltd’s accounts to 31 December 2025 fall due 30 September 2026 and will be the first that can.

Correction. This page previously said “none found”. There is a great deal. Four separate MHRA advertising interventions, in July 2025 (as Fella Health), December 2025, March 2026 (both brands) and July 2026 (email). Two ASA rulings upheld on 29 July 2026, one for promoting prescription-only medicines through price ads, one for running a Facebook page called “UK Weight Loss Reviews” without disclosing Bolt owned it. In the second, Bolt undertook to show no POM before a clinical consultation is completed; four weeks later /mounjaro is titled “Buy Mounjaro Online UK”.

The US parent is a defendant in litigation brought by both Eli Lilly and Novo Nordisk. The pharmacy itself has never been inspected by the GPhC, and the CQC registration is unrated.

This is the fact that reframes everything else.

Bolt Healthcare Ltd was incorporated on 19 September 2023 by Saim Dalvi, a pharmacist, and Maryam Mahmud. On 2 April 2025 both resigned as directors and ceased as PSCs on the same day, AIOS Technology Ltd took 75%+ ownership, and Richard Cartwright became sole director.

What was acquired, per the filed accounts for the 13 months to 30 October 2024: net assets of £2,290, total assets £491,360, cash £321,950, and one employee. A micro-entity with turnover under £1m.

And the consideration was not paid in full. Companies House charge code 1237 3906 0001, created 2 April 2025 and still outstanding, is a fixed charge over AIOS Technology Ltd, the acquiring company, in favour of Saim Dalvi and Maryam Mahmud personally. That is vendor financing: the sellers took security over the buyer for deferred consideration rather than cashing out.

Both sellers were then retained. Dalvi is now “Pharmacy Lead” on Bolt’s about page and, since 1 December 2025, company secretary of AIOS Technology Ltd, the entity his charge sits over.

So the regulatory foundation under a business claiming nine-figure revenue is thin, seventeen months old, and still partly unpaid for.

Y Combinator’s own directory lists AIOS as Winter 2020. The company brands itself everywhere as “YC W20/S21”. The reconciliation is almost certainly that Cartwright went through W20 with FlowX and Fella went through S21, but no primary source confirms S21.

Funding is not publicly established. Crunchbase shows one seed round led by YC. CB Insights says “$130K across 2 rounds”, which is almost certainly a data artefact. A company-supplied job listing names Y Combinator, BrandProject and Global Founders Capital plus angels including founders of Indeed, Curative, Alan and Vouch. GetLatka says bootstrapped. None of it is primary and none of it agrees.

The revenue claims are worse, because both are current-tense and both come from the company:

• The Y Combinator jobs page says “We’re >$100M/yr revenue”, “cashflow positive since June 2023”, “serving >50k customers”.
• A Bolt clinical pharmacist advert says “$400M ARR, growing from $10M/yr 12 months ago”, “>150k/mo patients”, “150k UK active GLP-1 patients”.

Those cannot both be true. Treat every figure here as an unverified marketing claim.

Bolt Healthcare’s only filed accounts predate the acquisition entirely. AIOS Technology Ltd’s accounts to 31 December 2024 show net assets of £217,970 and two employees, against a YC profile claiming a team of 100.

Bolt Healthcare’s first post-acquisition accounts, for the year to 31 October 2025, are not due until 30 July 2027.

But AIOS Technology Ltd’s accounts for the year ended 31 December 2025 fall due on 30 September 2026, roughly five weeks from the date of this dossier. That will be the first UK filing capable of testing any of the group’s revenue claims. It is the single cheapest diligence item on this page.

On 29 July 2026 the ASA upheld two rulings against Bolt Healthcare Ltd. In response Bolt told the ASA it had “updated their marketing practices to align with MHRA guidance” and committed to updating its processes so that users “complete a clinical consultation before any POMs were shown”.

Tested against the live site on 24 August 2026, four weeks later. A prescription-only brand name is reachable by an unauthenticated visitor at every one of these layers:

• The navigation. The “Weight Loss” nav item goes straight to /weight-loss-plans, and the raw markup of every page carries <a href="/mounjaro">Mounjaro</a> and <a href="/wegovy">Wegovy</a>.
• The plans page, one click from the homepage, shows photographs of branded Wegovy FlexTouch and Mounjaro KwikPen devices with the labels legible, headed “Wegovy® for Weight Loss” and “Mounjaro® for Weight Loss”, with weekly prices.
• The title tags. /mounjaro is titled “Buy Mounjaro Online UK | GLP-1 At-Cost Weight Loss Injections”. Neither brand page carries noindex.
• The structured data. The homepage JSON-LD describes the pharmacy as “providing weight loss treatments including Mounjaro and Wegovy at cost”. That is machine-readable POM promotion served to Google and, because robots.txt allows every AI crawler by name, to LLM training and retrieval too.
• The guide corpus. 5,776 articles, of which 315 slugs contain “mounjaro”, 265 “ozempic”, 237 “saxenda” and 208 “wegovy”, including can-you-buy-mounjaro-online and can-you-buy-mounjaro-over-the-counter. Two dedicated brand taxonomy hubs exist at /guide-category/mounjaro and /guide-category/wegovy.
• The guide pages themselves carry an embedded POM price widget: “Mounjaro, Prices from £149.00, Learn more about Mounjaro”.

The only thing actually gated behind the quiz is dose personalisation. There is no interstitial, no age gate, no eligibility wall, no filter page of any kind. If the ASA re-tested today on the same basis as A26-1333536 and A26-1335405, the position looks materially unchanged and in places expanded.

Worth noting, because it removes the “we did not realise” defence. Neither Mounjaro nor Wegovy is named in either app store listing. The iOS description reads only “Track your Bolt Pharmacy order, manage your treatment and continue your weight loss journey.”

Apple and Google enforce POM advertising rules at the platform level. The ASA and MHRA do not have that lever. Bolt writes to a compliant standard exactly where a platform makes it compulsory, and to a very different standard everywhere else.

This atlas now has both ends of the range documented.

Juniper Germany will not name the molecule at all until after payment, and cites the Heilmittelwerbegesetz on the page as the reason. Bolt UK puts “Buy Mounjaro Online UK” in a title tag and feeds it to every AI crawler by explicit allow rule.

Juniper UK sits between them and has five upheld ASA rulings for it. Bolt has two, plus four separate MHRA interventions. The pattern across the category is consistent: UK operators treat POM advertising rules as a cost of customer acquisition rather than a constraint on it, and the enforcement, which arrives as an instruction to stop running a specific ad, is priced in.

The file has exactly one disallow, /success, which is nonetheless publicly fetchable and returns HTTP 200. Everything else is an explicit allow, and the allow list is enumerated crawler by crawler:

GPTBot, ChatGPT-User, ClaudeBot, Claude-Web, anthropic-ai, Google-Extended, PerplexityBot, Bytespider, Applebot-Extended, cohere-ai, Amazonbot, Meta-ExternalAgent, YouBot, CCBot.

This is not an oversight. Naming fourteen AI user agents individually and allowing each is a deliberate AI-visibility strategy. The consequence is that pages titled “Buy Mounjaro Online UK”, and JSON-LD describing the pharmacy as supplying “Mounjaro and Wegovy at cost”, are being served into LLM training and retrieval by design. Juniper’s robots.txt blocks nothing either, but Juniper does not enumerate. Bolt went looking.

Certificate transparency returns 99 unique DNS names for boltpharmacy.co.uk. Ninety-three of them are per-creator subdomains: 47 `<handle>.affiliates.boltpharmacy.co.uk` and 46 `<handle>.crew.boltpharmacy.co.uk`.

Sample handles, verbatim from the certificates: mandoesmounjaro, slowlyshrinkingsoph, adhdweightlossmama, hollymaykay, kayleighlinnett, alfieandmummysteph, bonnieluellasmama, thethreemouseketeersuk.

`mandoesmounjaro.affiliates.boltpharmacy.co.uk` puts a prescription-only medicine brand name inside a hostname that Bolt controls and for which Bolt has obtained a TLS certificate. It currently serves a link-in-bio stub with noindex, but the certificate is public and permanent.

The creator programme runs on a Next.js dashboard at crew.boltpharmacy.co.uk (“Bolt Creator Dashboard”) hosted on Vercel. Set against ASA ruling A26-1335405, which upheld a breach for running a Facebook page called “UK Weight Loss Reviews” without disclosing Bolt owned it, an undisclosed-affiliation risk running at this scale is the most under-appreciated exposure in the whole file.

5,776 guide articles, of which 135 slugs contain “cost”. The pattern that matters is a matrix: 54 `<competitor>-mounjaro-cost` pages and 59 `<competitor>-wegovy-cost` pages.

Named targets include juniper, zava, voy, numan-adjacent brands, medexpress, oushk, simple-online-pharmacy, phlo-clinic, second-nature, pharmacy2u, lloyds-pharmacy, boots, asda, well-pharmacy, and, pointedly, `lillydirect`, the manufacturer’s own direct channel.

These are not thin pages. /guide/juniper-cost-mounjaro is an 11-minute read, published 18 November 2025 and last updated 23 August 2026, so the corpus is actively refreshed. It carries a Trustpilot badge, a POM price widget, a table of contents, scientific references, and a dated provenance citation: “Juniper’s Mounjaro service typically costs £199 to £339 (price-comparison listing, checked 21 August 2026)”. That dated “checked” note is a defensive move and it is well executed.

Bolt has also built more Ozempic content (265 slugs) than Wegovy content (208), despite not selling Ozempic. That is pure interception traffic.

Adjacent categories seeded but not sold: erectile-dysfunction, hair-loss, testosterone. That is either a roadmap or content ported from the US Fella playbook, and probably both.

The most strategically important stack finding. Bolt’s front-end JavaScript is served from `js.joinfella.com`, the Fella Health domain, with a testing fallback to js.fellatesting.com and telemetry to t.fellahealth.com. The RudderStack dataplane is literally named `joinfelladnoqz`. The backend is `uk.api.aiosmedical.com`, alongside us.api.aiosmedical.com.

The code is conditionally branched by hostname, so the same bundles serve consent management, CTA tracking and PostHog experimentation to both markets.

That single fact explains everything odd about the UK site: the un-localised “board-certified women’s health specialists” copy lifted from Delilah, the live Lorem ipsum, the American spellings, the stale app.joindelilah.com link in the UK homepage markup, and a San Francisco phone number, (415) 649-5531, live on a UK pharmacy homepage under “Talk to Someone”.

It also creates a real question: UK patient consent and event data flows through a US-branded pipeline. The privacy policy does not name Aios Inc.

Rest of the stack: Webflow behind Cloudflare, Stripe, GA4, GTM, PostHog for product analytics and feature flags, Omniconvert for CRO, Converge and Hyros for ad attribution, CustomerLabs, a custom consent bundle rather than OneTrust or Cookiebot, and WhatsApp Business as the only support channel. No Intercom, no Zendesk. polyfill-fastly.io is present, a successor host to the compromised polyfill.io, which is a supply-chain hygiene issue on a pharmacy site.

Read from Trustpilot’s own JSON on 24 August 2026, using the businessUnitId embedded in Bolt’s pages.

| Stars | Count | Share | |---|---|---| | 5 | 5,000 | 83.6% | | 4 | 282 | 4.7% | | 3 | 69 | 1.2% | | 2 | 67 | 1.1% | | 1 | 566 | 9.5% |

A healthy organic distribution decays smoothly from five stars down. This one has 566 one-star reviews against just 67 two-star, a spike of 8.4x where there should be a decay. That shape is characteristic of heavy review solicitation on satisfied customers inflating the top, while a distinct and unaddressed operational failure sends a hard core straight to the bottom. Roughly one reviewer in every ten and a half rates Bolt the lowest possible score.

Separately, /wegovy displays a hardcoded “Trustpilot 4.8/5” badge. The live score is 4.5. That is a straightforward substantiation problem on a product page.

This atlas previously recorded Bolt at “around 250 reviews”. It is now 5,984. Whatever else is true, the growth is real.

iOS: 4.5 from 924 ratings, published by Aios Inc., last updated 28 July 2026, age rating 18+.

Android: 2.3 from 57 reviews, package com.aios.boltpharmacy, 10,000+ downloads, last updated 8 July 2026, content rating “Rated for 3+”.

Two things follow. 10,000+ Android installs generating only 57 ratings against 924 on iOS suggests iOS ratings are actively solicited and Android is not. And a 2.3 on the app a patient must use to photograph their ID and take full-length BMI photos after they have already been charged is a real service failure, on the platform with the larger UK install base.

The 3+ content rating on an app that gates access to prescription-only medicines is its own small oddity.

The review text could not be read: Trustpilot returns 403 to automated clients. Rather than characterise 566 reviews from inference, here is the verified adjacent evidence, which points clearly at operations rather than clinical care.

• The plan page carries a live banner: “Due to high demand, orders will be processed within 1-2 weeks”, against a homepage promise of delivery “often as soon as the next day”. A 14x gap between promise and disclosure.
• The patient portal returned “We’re facing some technical challenges and some of our services are offline” during testing.
• No refunds on any medicine, combined with payment taken before clinician review.
• The patient must re-create an account using the same email used at checkout.
• The referral terms devote two sections to tracking failures.

Bolt also operates an owned subreddit, r/BoltUK, linked from the homepage footer. It should not be read as independent sentiment.