Skip to main content

​
Introduction

Your business runs on the data you keep in Bella Booking - client records, appointments, notes and payments. This page explains, in plain terms, how that data is protected and where it lives. If you work in a clinical, allied-health or med-spa setting and need something more formal for your own compliance, get in touch at hello@bellabooking.com.

​
Sign-in and accounts

Authentication is handled by Auth0, a specialist identity provider, on its Australian region. You can sign in with Google, Apple, or email and password. Passwords are never stored by Bella Booking - Auth0 manages credentials, and card entry never touches our own systems (see Payments). Access inside your business is role-based: each team member’s permissions are set by their role, so people only see and do what their role allows. You manage this from Team permissions, and a team member can only sign in once you’ve turned on Access enabled for them.

​
Encryption

  • In transit: all traffic between your browser or device and Bella Booking is encrypted over HTTPS/TLS (1.2 or higher) - data is never sent in the clear.
  • At rest: client and business data is encrypted at rest (AES-256) by our database and storage providers.
  • Tokens: payment and integration tokens are additionally wrapped with encryption keys held in Azure Key Vault, which only the application’s managed identity can use - not individuals.

​
Payments

Card payments are processed by Stripe or Square, both certified to PCI DSS Level 1. Bella Booking does not store raw card numbers - cards are tokenised by the payment provider, so sensitive card details never sit in Bella’s own systems. See Payments for how payment processing works.

​
Hosting

Bella Booking runs on Microsoft Azure in Australia East and MongoDB Atlas on Azure in Sydney, with sign-in handled by Auth0 in Australia. Specialist providers that help us run the product (payments, email, SMS, support, analytics and some AI features) may process personal information outside Australia. That is set out in our Privacy Policy. If your business is bound by rules on where client or health information may be held, email us at hello@bellabooking.com.

​
Access controls and tenant isolation

Every business’s data is scoped to its own account, with a separate database per location. The application enforces this separation on every request, so one business can never see or reach another business’s clients, appointments or records.

​
Certifications

Bella Booking runs on infrastructure certified to SOC 2 Type II and ISO 27001 (Microsoft Azure, MongoDB Atlas, Cloudflare) and PCI DSS Level 1 (Stripe). Bella Booking itself does not hold an application-level SOC 2 or ISO 27001 certification. If your procurement process needs a security overview, request one at hello@bellabooking.com.

​
Healthcare and sensitive information

Many businesses on Bella Booking - skin clinics, med spas, massage and beauty therapists - keep consent forms, patch-test records, treatment photos and clinical notes. Bella supports those workflows: team member forms, such as the ready-made SOAP note, are filled in by your team and never shown to the client, timeline notes can be locked and corrected by amendment, photos can be marked up, and files sit on the client or the appointment. It’s important to be clear about what Bella is: a scheduling and client-management platform, not a clinical records system. Bella does not provide Medicare/HICAPS/NDIS claiming, telehealth, or a HIPAA Business Associate Agreement. You remain responsible for your own professional and regulatory obligations for the records you keep.

​
Privacy and your rights

We handle personal information as described in our Privacy Policy, which covers what we collect, how it’s used, the specialist providers involved, overseas processing, and your rights under the privacy law that applies to you (in Australia, the Privacy Act 1988). You can export much of your data from the app (see Clients). If you need a full copy of everything we hold for your account, email hello@bellabooking.com.

​
Questions

For any security or compliance question - including anything specific to your industry’s requirements, a security questionnaire, or a data-processing agreement - email us at hello@bellabooking.com.