diff --git a/backend/server.js b/backend/server.js
index d3f7b25..5599983 100644
--- a/backend/server.js
+++ b/backend/server.js
@@ -1777,9 +1777,11 @@ app.get('/api/reports/productivity', async (req, res) => {
 });
 
 // --- AGENDAMENTOS ---
-app.get('/api/agendamentos', async (req, res) => {
+app.get('/api/agendamentos', tenantGuard, async (req, res) => {
     try {
-        const { rows } = await pool.query('SELECT * FROM agendamentos');
+        const clinicaId = req.clinicaId;
+        if (!clinicaId) return res.json([]); // sem clínica escopada → nada (isolamento entre unidades)
+        const { rows } = await pool.query('SELECT * FROM agendamentos WHERE clinica_id = $1', [clinicaId]);
         res.json(rows.map(r => ({
             ...r,
             dentistaId: r.dentistaid,
diff --git a/frontend/services/backend.ts b/frontend/services/backend.ts
index fe9712e..b85db57 100644
--- a/frontend/services/backend.ts
+++ b/frontend/services/backend.ts
@@ -704,15 +704,20 @@ export const HybridBackend = {
   },
 
   getAgendamentos: async (): Promise<Agendamento[]> => {
-    const res = await apiFetch(`${API_URL}/agendamentos`, {  });
-    return await res.json();
+    const clinicaId = HybridBackend.getActiveWorkspace()?.id || '';
+    if (!clinicaId) return [];
+    const res = await apiFetch(`${API_URL}/agendamentos?clinicaId=${clinicaId}`, {});
+    const data = await res.json().catch(() => []);
+    return Array.isArray(data) ? data : [];
   },
 
   salvarAgendamento: async (ag: Partial<Agendamento>) => {
+    const clinicaId = HybridBackend.getActiveWorkspace()?.id || '';
+    const body = { ...ag, clinica_id: (ag as any).clinica_id || clinicaId };
     const res = await apiFetch(`${API_URL}/agendamentos`, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify(ag)
+      body: JSON.stringify(body)
     });
     if (!res.ok) {
       const err = await res.json().catch(() => ({} as any));