Everything travels over an encrypted connection, and your data is stored encrypted. Access is restricted at the level of the record, so a studio can only reach the clients it actually has and cannot see anybody else's — that is enforced by the database itself rather than by the app remembering to ask.
Your password is stored as a one-way hash, which means nobody here can read it. That is also why a lost password is reset rather than looked up.
We are not in the payment flow for appointments, so we do not hold your card details at all. Payments go from you to the studio through their own provider, and the card number never reaches us.
The part that is yours: use a password you do not use anywhere else, keep the email address on your account current, and be wary of any message asking you to sign in through a link. We will never ask for your password.
If you think your account has been accessed by somebody else, change your password immediately and contact us. If you have spotted something wrong with the app's security, tell us that too — we would much rather hear it from you.