Client card and payment details should never sit in a clinic's own database. A properly built clinic app hands card numbers straight to a PCI-compliant payment processor, which returns a token the app uses for billing, deposits and memberships. The clinic and its software only ever see the last four digits and a reference, never the full card.
Updated 2 October 2026
What payment data does a cosmetic clinic's app actually handle?
A clinic app touches payment data at a few distinct moments: a booking deposit, a prepaid treatment package, a one-off product sale and, for membership models, a recurring monthly charge. Each of those needs a card number at the point the client types it in.
Recurring billing is the part that worries owners most. A membership or instalment plan has to charge the same card automatically every month, which sounds like it requires the clinic to keep the card on file somewhere. It does, but "on file" does not have to mean "on file at the clinic".
Does the clinic or its software ever see the full card number?
Not if the app is built correctly. When a client enters their card details, a well-built checkout sends that data directly to the payment processor's own systems, not to the clinic app's server. The processor stores the real card number in its own vault and hands the app back a token, a reference string with no card value on its own, that the app can use to trigger future charges. Stripe, for example, is certified as a PCI Service Provider Level 1, and its card data vault is part of that audit. Card handling is one piece of wider data security for Australian clinics, which also covers health records and photos.
Tokenisation is swapping a real card number for a meaningless reference that only the original payment processor can turn back into a chargeable card. If a clinic's database were ever exposed, a token on its own is useless to whoever took it.
The table below is what a client-facing clinic app should look like on the back end. If a vendor's answer to any of these does not match, that is worth asking about directly.
| Data | Where it actually lives | Who can see it |
|---|---|---|
| Full card number, CVV | Payment processor's vault only | Nobody at the clinic or the app vendor |
| Last 4 digits, card brand, expiry | Clinic app's database, for display only | Clinic staff, for identifying a saved card |
| Payment token | Clinic app's database | The app, to trigger a future charge |
What is PCI DSS, and does a small clinic need to worry about it?
PCI DSS (the Payment Card Industry Data Security Standard) is the set of security rules that apply to any business that stores, processes or transmits card data. It was written for the card networks, not for cosmetic clinics specifically, but it applies the moment a clinic takes card payments at all.
The size of that obligation depends entirely on the setup above. A clinic that never stores or transmits full card numbers itself, because a compliant processor handles that step, still has to attest to its compliance each year, but the obligation is far lighter, usually a short self-assessment confirming its checkout is built that way. A clinic or app that stored card numbers directly would face a much heavier compliance burden, and a much bigger target if something went wrong.
What happens to payment data during a refund or a disputed charge?
The payment processor, not the clinic, holds the transaction record and the evidence needed to process a refund or respond to a disputed charge. A clinic issuing a refund does it through its billing dashboard against the original transaction, without ever needing to see or re-enter the client's card number.
If a client disputes a charge with their bank, the processor runs the dispute process and the clinic supplies supporting evidence through it, such as the booking record or a signed consent form. The clinic's job is to keep its own side of that evidence, like appointment history, in its booking and app records, not to hold the card details that made the payment possible.
A clinic does not need to become a card-data vault to take deposits and run recurring billing. The safer version is to never hold the card data in the first place.
What should a clinic ask before trusting an app with payment details?
- Which payment processor do you use? A named, well-known processor (Stripe is one widely used example) is a good sign. "We built our own" is not.
- Is a full card number ever stored in your own database? The correct answer is no.
- What is your PCI compliance level, and can you show it? A vendor that cannot answer this plainly has not thought about it.
- What happens to saved cards if we switch software? Tokens are usually tied to the processor account, not portable between vendors, so this is worth understanding before signing up, not after.
A vendor that answers these clearly and quickly is telling you something useful about how the rest of the product was built too. Our data security guide covers the same due-diligence habit for client health and photo data, not just payment details.
Clinic App is built for the Australian cosmetic and skin clinic market and runs deposits, packages and membership billing through Stripe. Card numbers are captured and held in Stripe's own vault, never in Clinic App's database, so nobody at the clinic and nobody at Clinic App ever sees a full card number.
Frequently asked questions
Is client payment data safe in a clinic app?
Yes, when the app uses a proper payment processor instead of storing card details itself. Card numbers should go straight from the client's browser or terminal to a PCI-compliant processor, which returns a token the app can use for billing. The clinic and its software never hold the actual card number.
Does Clinic App store client card numbers?
No. Clinic App processes deposits, packages and membership billing through Stripe. Card details are captured and held in Stripe's own vault, never in Clinic App's database, so nobody at the clinic and nobody at Clinic App ever sees a full card number.
What is PCI DSS compliance?
PCI DSS (Payment Card Industry Data Security Standard) is the set of security rules that apply to any business that stores, processes or transmits card data. A clinic that never holds full card numbers itself, because a compliant processor handles that step, carries a much lighter PCI obligation than one that stores card details directly.
What happens to payment data if a client disputes a charge?
The payment processor holds the transaction record and evidence needed for a dispute or chargeback, not the clinic. The clinic can usually see the outcome and reference details in its billing dashboard without ever needing to store or re-enter the client's card number.
Should a clinic ask its software vendor how it handles payment data?
Yes. Before trusting any app with billing, ask which payment processor it uses, whether card numbers are ever stored in the vendor's own database, and what its PCI compliance level actually is. A vendor that cannot answer clearly is a bigger risk than the software itself.
