The short version
- Don't keep card verification codes.
- Store tokens through a processor-approved system.
- Link later charges to the customer's permission.
- Check staff practices and records outside the payment system.
Keeping a card on file can help with deposits, no-shows, memberships, products and later balances. It becomes unsafe when staff copy details into intake notes, email, texts, paper or shared spreadsheets.
Check staff and vendor practices for tokenized cards and payment data kept outside the approved system. Work through a recent medical spa sale with its payment records.
Interactive owner tool
Med Spa Stored-Card Safety Checklist
Check where staff might keep card details.
- Tokenized vault approved for use
- No CVV retained after authorization
- Permission for a card on file recorded in writing
- Purpose of later charges specified
- Customer can update or remove the credential
- Staff access limited by role
- Email and notes contain no card data
- Transaction activity recorded
Change the inputs on the live page. The calculator runs in your browser, using only the values you enter.
Use with this guide
Med-spa membership card updates: use a secure handoff
Route med-spa membership card updates through the supported payment system. Use the handoff worksheet without collecting card credentials or treatment information.
Browse the complete medical spa guides and worksheets.
Use a tokenized system for cards on file
Look through the places staff use during a busy shift: booking notes, email, texts, paper forms, the virtual terminal and shared spreadsheets. If any of them retains a card verification code after authorization, the check fails.
Don't copy full card numbers or verification codes into booking notes, email, chat or spreadsheets. PCI guidance prohibits keeping the verification code after authorization, even if the customer asks you to save it.
For med spas, use the right payment totals. Count settled card sales and deposits paid by card only once. Leave out cash, checks, ACH, financing proceeds, insurance payments, gift-card redemptions and uncollected balances.
Work through "medical spa card-on-file and pci checklist" with a real transaction
Check stored cards in booking software, terminals, virtual terminals, forms, notes and memberships, including role access, tokenization and CVV storage.
Check staff and vendor practices for tokenized cards and payment data kept outside the approved system. Review a completed medical spa sale, not just a demonstration. Have the original amount, payment method, customer terms, changes, receipt, settlement record and any later adjustment beside you.
- For Medical Spa Card-on-File and PCI Checklist, the "explain at consultation" step: Before taking money or reserving treatment time, show payment options and written deposit terms. Identify the screen, document and person responsible for this step.
- For Medical Spa Card-on-File and PCI Checklist, the "connect the treatment payment" step: Link each payment to the service, package balance, expiration terms and client record. Leave unnecessary clinical details off receipts. Identify the screen, document and person responsible for this step.
- For Medical Spa Card-on-File and PCI Checklist, the "record membership permission" step: Get clear permission for recurring charges. Keep enrollment, renewals, cancellations, retries and refunds in the same record. Identify the screen, document and person responsible for this step.
- For Medical Spa Card-on-File and PCI Checklist, the "reconcile after the visit" step: Match delivery, product purchases, package use, final receipts, credits, refunds and later disputes to your records. Identify the screen, document and person responsible for this step.
Work with the Med Spa Stored-Card Safety Checklist
Keep your source reports beside the tool. Check the booking system, terminal, virtual terminal, forms, shared inboxes, paper files and staff practices. Even with a compliant vendor, card details can still end up in unsafe places outside its system.
- Approved method for tokenized storage
- Written permission for recurring charges or a card on file
- Purpose and scope of later charges
- How customers update or remove the saved credential
- Staff access controls and activity records
Med spa: stored-card review steps
Follow a recent medical spa sale through this table. It lists the industry's usual handoffs; replace the labels with the documents or screens your team uses.
| Stage | What to verify | Purpose |
|---|---|---|
| Explain at consultation | Before taking money or reserving treatment time, show payment options and written deposit terms. | File the stored-card review record here. |
| Connect the treatment payment | Link each payment to the service, package balance, expiration terms and client record. Leave unnecessary clinical details off receipts. | File the stored-card review record here. |
| Record membership permission | Get clear permission for recurring charges. Keep enrollment, renewals, cancellations, retries and refunds in the same record. | File the stored-card review record here. |
| Reconcile after the visit | Match delivery, product purchases, package use, final receipts, credits, refunds and later disputes to your records. | File the stored-card review record here. |
What to save for the stored-card review
File these records while you can still trace the sale easily. A refund, cancellation, failed collection or dispute makes missing records much harder to reconstruct.
- Vendor's statement of PCI responsibilities
- Dated agreement from the customer
- Result of the first authorization
- Identifiers for subsequent transactions
- History of credential updates, removal and cancellations
What BlueFinch would check for med spas
BlueFinch would use the same medical spa payment mix to compare all proposed percentage charges and fixed fees. Monthly, PCI, gateway, batch, chargeback, software and other account-specific costs may still apply.
BlueFinch currently offers a standalone terminal at no charge, without an equipment lease, long-term contract or cancellation fee. Eligible, configured credit and debit transactions can have a 0% merchant processing rate after review of the state, network, acquirer, written price display and payment channels.
Questions business owners ask
Can we keep a CVV if the customer agrees?
No. PCI guidance prohibits keeping the verification code after authorization, regardless of the customer's permission.
How should we store a payment credential?
Use a tokenized vault approved by the processor. Limit staff access, keep an activity record and let customers update or remove their credentials.
When do med spas need help with the review?
Pause if the statement, written price, customer documents, terminal or receipt disagree. Before the medical spa launches, its processor or acquirer should approve the specific setup.
Primary sources
BlueFinch last reviewed these sources on August 11, 2026. Payment rules and state requirements can change.
- PCI Security Standards Council: Card Verification Codes and Recurring Payments
- Visa: Stored Credential Transaction Framework
- HHS: Covered Entities and Business Associates
- HHS: Business Associates
Use this page for general business information. It is not legal, tax, or accounting advice.