1- I mean, it looks like you don't verify that the phone number provided is really a number and it doesn't check the presence of @ (or use the usual regexp) in the email field. Also, if it's publicly available on the web, i'll add some captcha or similar to it.

4- I'd try offering (or A/B testing it for some time) both the pay-per-use and monthly fee option(limited number of appointments/month) and decide which works better. Intuitively i agree that the users should prefer the pay per use option, but sometimes testing proves that our assumptions where wrong. But i understand that testing this, you'll need to eventually support both contract type even if you decide to keep only one...

5- Yep my fault, i just remembered the calendar interface and assumed it had customer facing pages too.