When Your Platform Becomes Your Predator

How Shopify quietly undermines the businesses it claims to serve — a documented case study from inside an 18-year medical clinic that watched its platform impair every critical business function simultaneously.

Author: Ody, The Wellkeeper · Published: February 26, 2026 · Read time: 12 min

Tags: shopify, platform-dependency, smb, payments, fsa-hsa, merchant-rights, naturomedica, case-study, ecommerce, consumer-advocacy, structural-incentives, checkout-hijacking, fund-holds, eight principles, WellSpr.ing

Shopify tells small businesses they're the path to independence. "Be your own boss." "Own your brand." "The future of commerce is yours."

What they don't tell you is that once you're on their platform — once your products are loaded, your customers are routed through their checkout, your revenue flows through their payment processor — you've handed the keys to someone who may not have your interests at heart.

This isn't a hypothetical. This is a documented case study from inside a medical clinic that spent 18 years building a practice, only to watch Shopify systematically impair its ability to function — across multiple vectors, simultaneously, during the most critical months of a platform migration.

We're publishing this because we believe SMBs deserve to know what they're signing up for. And because the pattern we've experienced isn't unique to us. It's structural.

The Business: A Licensed Medical Clinic, Not a Supplement Startup

Naturomedica is a licensed primary care medical clinic in Redmond, Washington. Founded in 2008. Two physician co-founders — both licensed Naturopathic Doctors under Washington State law with prescriptive authority, diagnostic privileges, and active patient panels.

The clinic processes over $500,000 per month in revenue. Office visits, laboratory services, IV therapy, provider-directed supplements. The integrated dispensary exists because physicians prescribe specific supplements as part of individualized treatment plans — not because someone decided to sell vitamins on the internet.

The online presence, Naturologie.com, extends the clinic's reach to patients who need ongoing access to their prescribed supplements between visits.

This business has operated for over two decades with a clean compliance record, minimal chargebacks, and consistent revenue from a vendor that pays its own suppliers on time, fairly and without nonsense. There is nothing speculative, risky, or ambiguous about it.

In late 20245, the decision was made to migrate from Lightspeed to Shopify Plus. The sales team made promises. The contract was signed. And then the problems began.

Vector 1: Payment Fund Holds — Your Money, Their Timeline

In January 2026, Shopify Payments held all funds from the Naturologie store. Not some funds. All of them.

This is a business with 18 years of operating history. Minimal chargebacks. Clean processing record. No fraud flags. No disputed transactions.

Shopify Payments — which is functionally Stripe wearing a Shopify jersey — decided unilaterally to hold revenue that the business had already earned, from products already shipped, to customers who had already received their orders.

No advance warning. No clear criteria for release. No escalation path that produces a human being with authority to resolve it.

For a small business, a fund hold isn't an inconvenience. It's an existential threat. Payroll, inventory, rent, insurance — these don't wait for Shopify's risk algorithms to finish their computations. A single month of held funds can cascade into missed payments, strained vendor relationships, and damaged credit.

The message this sends is unmistakable: your revenue is not yours until Shopify decides it is.

Vector 2: FSA/HSA Payment Blocking — Gatekeeping a Medical Clinic's Core Function

This one deserves careful attention because it reveals how bureaucratic indifference can effectively destroy a business's competitive advantage.

Naturomedica has processed FSA and HSA payments through Lightspeed for years. These are Health Savings Account and Flexible Spending Account cards — tax-advantaged funds that patients use to pay for qualified medical expenses. The clinic is classified under MCC 8099 (Health Practitioners, Medical Services), which is the correct merchant category code for a licensed medical provider. HSA/FSA cards clear on the Visa and Mastercard networks without incident because the business is what it says it is: a medical clinic.

When the clinic migrated to Shopify, it expected to continue accepting the same payments it had always accepted. Instead, Shopify's "payment processing partners" denied FSA/HSA eligibility.

The reason? They looked at the product catalog — supplements — and concluded it was a supplement company. They never examined the revenue breakdown. They never considered the clinical context. They applied a screening filter designed to catch retail vitamin shops and caught a licensed medical clinic in the net.

The numbers tell the story clearly: 57% of revenue comes from office visits. 7.4% from laboratory services. 8.6% from IV therapy and procedures. The dispensary represents 24.6% — and every product in it is prescribed by a licensed physician for a diagnosed patient.

Core medical services alone account for 73% of revenue. Total healthcare-related revenue: 99.96%. Shopify's own published threshold is 90%.

A formal appeal was submitted with complete documentation — the Lightspeed processing statement showing 1,682 transactions with zero HSA/FSA compliance issues. A detailed revenue breakdown by category. Provider credentials. The IRS Publication 502 analysis demonstrating eligibility.

The response from Shopify's support specialist was polite but revealing. The "payment processing partners" — a euphemism for Stripe — could not review the account for eligibility unless the store was active and using Shopify Payments. But they had already denied eligibility. So the clinic was caught in a loop: can't get approved without being active, can't be active without being approved.

Brandon, the support specialist, suggested two alternatives: set up an expansion store to trigger a new review (requiring the clinic to duplicate its entire product catalog and migrate operations on faith), or use TrueMed — a third-party service that processes FSA/HSA payments "offsite" for an additional fee.

Read that again. Shopify's solution to incorrectly classifying a medical clinic is to suggest the clinic pay a third party to process the payments that Shopify should be processing natively.

This isn't a technical limitation. It's a business model conflict. Every dollar processed through TrueMed is a dollar that doesn't flow through Shopify Payments — except Shopify gets to keep the clinic on their platform while someone else solves the problem they created.

Meanwhile, the same cards, the same patients, the same transactions clear perfectly on Lightspeed every single day.

Vector 3: Checkout Hijacking — Steering Customers Away from Your Store

This one is subtle. And precisely because it's subtle, it may be the most damaging.

Shopify's "Shop" integration — the unified account system they've built across their ecosystem — intercepts the checkout experience in ways that actively harm merchants.

Here's what we observed: a long-time patient, a senior citizen, attempted to reorder her regular supplements. She had purchased from Naturologie before. But instead of completing her purchase on our store, the Shop sign-in flow redirected her to account.naturologie.com/orders — a Shopify-controlled page that shows order history but disconnects the customer from the storefront.

She spent 30 minutes trying to figure out how to buy her supplements. Nearly abandoned a $398 order. Not because our site was confusing — because Shopify's account system hijacked her session and dropped her into an experience optimized for Shopify's data collection, not for our business's conversion.

For a senior customer base — which describes a significant portion of medical clinic patients — this isn't a minor UX friction. It's a deal-breaker. These customers don't troubleshoot OAuth flows. They give up. They call the clinic. They ask staff to place the order manually. Or they don't order at all.

Now consider the implications at scale. How many customers across how many merchants are being silently redirected away from the storefront experience the merchant built and into a Shopify-controlled interface? How many abandoned carts are caused not by the merchant's design choices but by Shopify's platform decisions?

And here's the question no one at Shopify will answer: where does the customer go when they leave that Shopify-controlled account page? Does Shopify surface competitor products? Does the Shop app show "similar items" from other merchants? When your customer is inside Shopify's ecosystem instead of inside your store, whose interests are being served?

Vector 4: Advertising That Never Starts

A Shop advertising campaign was set up and approved. Budget allocated. Campaign launched.

It never started. No impressions. No clicks. No explanation. Just a campaign that exists on paper and delivers nothing in practice.

Is this incompetence? A technical glitch? Or is it deprioritization of a merchant whose account was already flagged by the payment processing "review"?

We don't know. And that's part of the problem. When you're dependent on a platform for discovery, checkout, payments, and advertising, you have no way to diagnose which failures are accidents and which are systemic.

The Pattern: Platform Dependency as a Vulnerability

Each of these vectors is damaging on its own. Together, they paint a picture of something more concerning: a platform that has accumulated so much control over the merchant's business that it can impair operations across every critical function simultaneously.

Consider what Shopify controls for a merchant on their Plus plan: Discovery — through Shop app, SEO tools, and advertising. Checkout — the entire purchase flow. Payments — through Shopify Payments (Stripe). Customer identity — through Shop accounts. Fund disbursement — when you get paid. Payment method eligibility — which cards you can accept. Account pages — what customers see after login.

That's not a service provider. That's a landlord who controls the locks, the utilities, the mailbox, and the front door — and who can change the terms of any of them at any time, without notice, and without a meaningful appeals process.

The Structural Incentive Problem

The question isn't whether Shopify intends to harm merchants. The question is whether their structural incentives are aligned with merchant success.

Shopify is a public company with a market capitalization that demands perpetual growth. Their revenue comes from three sources: subscription fees, payment processing fees, and their growing ecosystem of services (Shop app, Shop Pay, Shopify Capital, Shopify Audiences).

Every one of those revenue streams benefits from merchants being dependent on Shopify — and suffers when merchants are independent.

When a merchant processes payments through an alternative gateway, Shopify loses processing revenue. When a customer completes a purchase without entering the Shop ecosystem, Shopify loses data. When a merchant builds their own identity system, Shopify loses the cross-merchant network effects that make Shop valuable to investors.

This creates a structural tension: Shopify's growth depends on increasing platform control, while merchant success depends on decreasing platform dependency.

That tension is invisible when everything is working. It becomes devastatingly visible when something goes wrong — and you discover that the entity controlling your payments, your checkout, your customer accounts, and your advertising is not obligated to resolve your problem on any particular timeline, or at all.

What Can be done

The opportunity here is to transmute the lemon of bad practice into the lemonade of a template for success.

The storefront is being rebuilt in a headless architecture using Replit that reduces Shopify to what it should be: an inventory and fulfillment API. Nothing more. Everything that touches customers — design, content, authentication, account management, the entire experience — will be owned infrastructure that no platform can unilaterally impair.

The company is exploring a return to legacy payment processors that process FSA/HSA transactions without the bureaucratic theater Shopify demands.

The company will deploy a customer identity layer that doesn't route through Shop's ecosystem, so patients can reorder their supplements without being hijacked into an account page optimized for someone else's business model.

This account — with documentation — is published because transparency is the best disinfectant for platform abuse.

What SMBs Should Ask Before Committing to Shopify

If you're considering Shopify, or if you're already on the platform, ask these questions.

About payments: What happens if Shopify Payments holds your funds? What is the appeals process? What is the timeline? Is it contractually defined, or is it "trust us"?

About FSA/HSA: If your business qualifies for health spending account payments through another processor, will Shopify honor that classification? Or will you have to re-prove your eligibility to a third party that has no context for your business?

About checkout: Do you control the entire customer experience from product discovery to order confirmation? Or does Shopify insert their own interfaces (Shop Pay, Shop accounts) that redirect customers away from your storefront?

About customer identity: When your customer signs in, where do they land? On your store, with your products and your content? Or on a Shopify-controlled page that you don't design, don't manage, and can't customize?

About exit: If you decide to leave Shopify, what do you take with you? Your product data, presumably. But what about your customer relationships? Your order history? Your SEO equity? How much of your business is portable, and how much is locked inside Shopify's ecosystem?

About leverage: If something goes wrong — a fund hold, a payment method denial, a checkout issue — what leverage do you have? Can you call someone with authority? Is there an SLA? Or are you submitting tickets into a queue and hoping for the best?

The Larger Question

We don't think Shopify set out to harm small businesses. We think they set out to build a platform, and the platform's growth incentives have gradually diverged from merchant interests in ways that are now impossible to ignore.

The fund holds, the FSA/HSA blocking, the checkout hijacking, the advertising that doesn't deliver — these aren't isolated incidents. They're symptoms of a platform that has accumulated too much control over too many critical business functions, and that faces no meaningful accountability when that control is exercised poorly.

The solution isn't to avoid platforms entirely. The solution is to ensure that no single platform controls your payments, your customer relationships, your checkout experience, and your revenue disbursement simultaneously. Diversification isn't just a financial strategy. It's a survival strategy.

For our part, we're building WellSpr.ing as an alternative model — one where the infrastructure serves consumer and vendor. Where payment processing, customer identity, and clinical tools are integrated without being captive. Where the merchant's interests and the platform's interests are structurally aligned, because the platform succeeds only when the merchant succeeds.

That's the business we want to be in. Shopify has made it clear — through action, not words — that it's not the business they're in today. May their governors resolve to do better henceforth as capital markets properly footnote the existential risk of a viable alternative path to critical dependence on organizations that abuse market position.

---

*Naturomedica is a licensed primary care medical clinic in Issquah, Washington, operating since 2003. Naturologie.com is the clinic's integrated supplement dispensary. All facts stated herein are documented and available for review.*

— Ody, Consumer Advocate, WellSpr.ing, MMXXVI