The short version
- Don't keep card verification codes.
- Store tokens through a processor-approved system.
- Link later charges to the customer's permission.
- Check staff practices and records outside the payment system.
A card on file may support bookings, memberships, late-cancellation charges and package balances. Staff shouldn't copy its details into booking notes or shared files just to get faster access.
Check tokenized-card practices and keep payment details out of email, notes, forms and spreadsheets. Work through a recent wellness center sale with its payment records.
Interactive owner tool
Wellness Center Stored-Card Safety Checklist
Check where staff might keep card details.
- Tokenized vault approved for use
- No CVV retained after authorization
- Permission for a card on file recorded in writing
- Purpose of later charges specified
- Customer can update or remove the credential
- Staff access limited by role
- Email and notes contain no card data
- Transaction activity recorded
Change the inputs on the live page. The calculator runs in your browser, using only the values you enter.
Browse the complete wellness center guides and worksheets.
Use a tokenized system for cards on file
Look through the places staff use during a busy shift: booking notes, email, texts, paper forms, the virtual terminal and shared spreadsheets. If any of them retains a card verification code after authorization, the check fails.
Don't copy full card numbers or verification codes into booking notes, email, chat or spreadsheets. PCI guidance prohibits keeping the verification code after authorization, even if the customer asks you to save it.
For wellness centers, use the right payment totals. Include completed card payments and deposits paid by card only once. Leave cash, checks, ACH, employer invoices, financing proceeds, gift-card redemptions and unpaid bookings out of the total.
Work through "wellness center card-on-file and pci checklist" with a real transaction
Check stored cards across booking tools, terminals, forms, notes, memberships and no-show charges, including access, tokenization, updates, removal and CVV storage.
Check tokenized-card practices and keep payment details out of email, notes, forms and spreadsheets. Review a completed wellness center sale, not just a demonstration. Have the original amount, payment method, customer terms, changes, receipt, settlement record and any later adjustment beside you.
- For Wellness Center Card-on-File and PCI Checklist, the "explain before booking" step: Show payment options and cancellation terms before taking a deposit or storing a card. Identify the screen, document and person responsible for this step.
- For Wellness Center Card-on-File and PCI Checklist, the "link the service and payment" step: Match the payment to the appointment, attendee, package balance, instructor, location and written terms. Identify the screen, document and person responsible for this step.
- For Wellness Center Card-on-File and PCI Checklist, the "keep a membership record" step: Record recurring permission, billing dates, retries, freezes, cancellations, credits and refunds together. Identify the screen, document and person responsible for this step.
- For Wellness Center Card-on-File and PCI Checklist, the "separate the payment channels" step: Distinguish studio payments, mobile jobs, events, corporate invoices, product sales and later adjustments. Identify the screen, document and person responsible for this step.
Work with the Wellness Center Stored-Card Safety Checklist
Keep your source reports beside the tool. Check the booking system, terminal, virtual terminal, forms, shared inboxes, paper files and staff practices. Even with a compliant vendor, card details can still end up in unsafe places outside its system.
- Approved method for tokenized storage
- Written permission for recurring charges or a card on file
- Purpose and scope of later charges
- How customers update or remove the saved credential
- Staff access controls and activity records
Wellness center: stored-card review steps
Follow a recent wellness center sale through this table. It lists the industry's usual handoffs; replace the labels with the documents or screens your team uses.
| Stage | What to verify | Purpose |
|---|---|---|
| Explain before booking | Show payment options and cancellation terms before taking a deposit or storing a card. | File the stored-card review record here. |
| Link the service and payment | Match the payment to the appointment, attendee, package balance, instructor, location and written terms. | File the stored-card review record here. |
| Keep a membership record | Record recurring permission, billing dates, retries, freezes, cancellations, credits and refunds together. | File the stored-card review record here. |
| Separate the payment channels | Distinguish studio payments, mobile jobs, events, corporate invoices, product sales and later adjustments. | File the stored-card review record here. |
What to save for the stored-card review
File these records while you can still trace the sale easily. A refund, cancellation, failed collection or dispute makes missing records much harder to reconstruct.
- Vendor's statement of PCI responsibilities
- Dated agreement from the customer
- Result of the first authorization
- Identifiers for subsequent transactions
- History of credential updates, removal and cancellations
What BlueFinch would check for wellness centers
BlueFinch would use the same wellness center payment mix to compare all proposed percentage charges and fixed fees. Monthly, PCI, gateway, batch, chargeback, software and other account-specific costs may still apply.
BlueFinch currently offers a standalone terminal at no charge, without an equipment lease, long-term contract or cancellation fee. Eligible, configured credit and debit transactions can have a 0% merchant processing rate after review of the state, network, acquirer, written price display and payment channels.
Questions business owners ask
Can we keep a CVV if the customer agrees?
No. PCI guidance prohibits keeping the verification code after authorization, regardless of the customer's permission.
How should we store a payment credential?
Use a tokenized vault approved by the processor. Limit staff access, keep an activity record and let customers update or remove their credentials.
When do wellness centers need help with the review?
Pause if the statement, written price, customer documents, terminal or receipt disagree. Before the wellness center launches, its processor or acquirer should approve the specific setup.
Primary sources
BlueFinch last reviewed these sources on August 11, 2026. Payment rules and state requirements can change.
- PCI Security Standards Council: Card Verification Codes and Recurring Payments
- Visa: Stored Credential Transaction Framework
- Federal Trade Commission: Free Trials, Auto-Renewals, and Subscriptions
Use this page for general business information. It is not legal, tax, or accounting advice.