These answers summarise draft policy documents. The full Support Policy, SLA, Escalation Matrix, Maintenance Schedule, Warranty Terms, Security Policy and Implementation Methodology are the authoritative versions, and the signed commercial agreement takes precedence over anything on this page.
Getting support
When can we reach you?
Monday to Friday, 8:00 a.m. to 6:00 p.m. Ghana Time, excluding Ghana public holidays. Critical production issues can be raised outside these hours through the agreed urgent contact path. Hours may be extended by written agreement during go-live and the initial production period.
How do we raise an issue?
- Client portal — the primary channel for normal requests, documentation and formal issue tracking.
- Email — when you need a written record, screenshots, logs or approvals.
- Phone or WhatsApp — urgent production disruption and go-live coordination. Used for triage, then followed by a written summary.
- Remote session — scheduled, or started during an incident, when we need to see the affected environment with your permission.
What is covered?
The agent desktop application, the local server application and its database, and the Anlo HCPS client portal — plus remote troubleshooting, maintenance coordination and release assistance during an active managed service period.
What is not covered?
Hardware, power, internet, VPN, POS terminals, Apex Bank and the diagnostic-centre system are third-party items. We help coordinate them on a best-effort basis, but they sit outside the supported software unless a written agreement says otherwise.
When is a case closed?
After you confirm the resolution, or five business days after a closure notice with no response. A closed case can be reopened if the same issue recurs within seven calendar days. Enhancement requests are tracked separately from incidents and may need commercial approval.
Severity & response targets
| Severity | What it means | Acknowledged | Workaround | Resolution or plan |
|---|---|---|---|---|
| P1 Critical | Collection is unavailable, or an integrity issue blocks safe payment processing. Agents cannot collect; receipts cannot be issued; duplicate posting risk. | 30 min in hours 60 min after hours |
4 hours where feasible | 1 business day for fix plan |
| P2 High | A major feature is impaired but a temporary workaround exists. Report export blocked; sync queue needs review; channel tagging fails. | 2 business hours | 1 business day | 3 business days |
| P3 Medium | A non-critical defect affecting convenience, reporting or a limited workflow. Search filter mismatch; minor receipt layout issue. | 1 business day | As scheduled | 10 business days |
| P4 Low | A question, enhancement request, documentation correction or planned change. | 2 business days | — | Backlog or change request |
Targets start once we have enough information to classify and investigate, and they pause while we wait on information, access approval, a third party, hardware replacement or site availability. Resolution can mean a permanent fix, a workaround, a configuration change, a handover to a third party, or a written explanation where the cause is outside our control.
Availability
| Component | Target | Notes |
|---|---|---|
| Client portal | 99.0% monthly | Excludes planned maintenance, force majeure, customer network blocks and third-party outages. |
| Local collection workflow | Local-first continuity | Depends on the local server, workstation, power, printer and site network maintained by Anlo or the site. |
| Remote support | During support hours | Critical issues may use the urgent path outside hours. |
| Software updates | Maintenance window | Emergency updates may be delivered sooner for security or stability. |
Service credits are not automatically included unless the signed commercial agreement says so. The primary remedy is prompt support, workaround, correction, escalation and service improvement.
Escalation
Who handles an issue as it grows?
- Level 1 — Support Engineer or Customer Success Lead. Logs the case, classifies severity, provides known workarounds.
- Level 2 — Technical Lead. Engaged for P1 and P2, repeated P3 defects, and database, sync, release, integration or security concerns.
- Level 3 — Project Lead or Managing Director. Engaged for business-impacting P1, contractual risk, security incidents or a missed target.
- Level 4 — the external dependency owner, when the cause is traced to bank IT, Apex Bank, the diagnostic-centre system, the POS provider, hosting or an ISP. We coordinate the handover and keep Anlo informed until closure.
How often will we hear from you during an incident?
A P1 moves to Level 2 and Level 3 immediately and receives updates at least hourly until stable. P2 is updated every business day, P3 at meaningful progress points. Every P1 and P2 gets a written incident thread with a named owner, and every P1 gets a post-incident summary covering timeline, impact, cause, corrective actions and prevention.
Who do you need on our side?
A bank operational contact to confirm business impact and approve workarounds, a bank IT contact for VPN, firewall, server, printer and Apex Bank connectivity, and a diagnostic-centre contact for invoice lookup availability and source system access.
Maintenance & updates
When does maintenance happen?
The standard window is Sundays, 6:00 a.m. to 10:00 a.m. Ghana Time. Changes that affect users are communicated at least two business days beforehand where practical. Emergency security or stability maintenance may fall outside the window, with best-effort notice.
Does maintenance stop us collecting payments?
Usually not. The local-first design means collection continues through many internet and portal maintenance events, as long as the local server and workstation are available.
How are updates released?
Release notes and impact assessment first, then testing in a controlled environment for non-urgent updates, then notification of user-visible changes, downtime and rollback approach. After deployment we check login, invoice lookup, payment recording, receipt printing, sync and report export.
What is checked routinely?
- Daily — health signals, sync warnings, backup status, critical error alerts.
- Weekly — application logs, open cases, known issue register, update readiness.
- Monthly — approved updates, dependency patches, backup readiness, active accounts.
- Quarterly — access review, disaster recovery walkthrough, contact check, policy review.
- Annually — architecture, security, SLA, retention and support-process review.
How long is data kept?
Operational logs for up to 90 days and backups for 30 days unless you request otherwise in writing or an incident, audit or legal obligation requires longer. Transaction records follow the bank's own operational, audit and regulatory requirements as agreed in writing.
Warranty
| Item | Position |
|---|---|
| Software defect warranty | 30 calendar days from written acceptance or production go-live, whichever comes first, unless the signed agreement says otherwise. |
| Satisfaction guarantee | 30 calendar days, limited to failure to meet agreed specifications, subject to a reasonable opportunity to correct. |
| Managed service | First three months included where stated in the commercial proposal, then renewable by monthly fee. |
| Third-party services | Passed through only to the extent the provider offers. We do not warrant third-party platforms, networks, APIs or devices. |
What falls outside warranty?
Hardware, power, printer and POS faults; outages at Apex Bank, the diagnostic centre, the POS provider, an ISP, firewall, VPN or hosting; unauthorised modifications, unsupported configuration changes and malware introduced outside our control; changes in law, bank policy or third-party API terms after acceptance; and data quality issues from source systems or manual entry.
Who owns the software?
Where the final agreement says Anlo owns the delivered software, that ownership covers the custom deliverables described in the agreement. Seraph retains pre-existing tools, libraries, generic platform components, templates and know-how not unique to Anlo, unless the signed agreement says otherwise.
Security & data
Which regulations apply?
The Data Protection Act, 2012 (Act 843) and the Cybersecurity Act, 2020 (Act 1038), alongside Data Protection Commission guidance on lawful processing, purpose limitation, openness and security safeguards. Bank, healthcare and payment obligations should be confirmed against the final operating model with professional legal advice.
What patient data do bank agents see?
Only payment-relevant details: invoice reference, patient ID or account reference, service description, amount and receipt details. Clinical information is not exposed to the payment workflow unless specifically required and approved.
Is our data sold or used to train AI?
No. We do not sell customer, patient or end-user data. Where an AI routing service such as OpenRouter supports assisted support or documentation, providers are configured so submitted data is not used for model training, and personal data is minimised or redacted first. Credentials, production secrets and full patient records are never submitted to AI services.
How is access controlled?
- Every production user has an individual account. Shared accounts are not permitted.
- Role-based access for Agent, Supervisor, Administrator and Seraph Support.
- Administrative access is limited and reviewed at least quarterly.
- Sessions lock automatically after a configurable inactivity period.
- Access is removed promptly when someone leaves or changes role.
What technical controls are in place?
TLS on internal and external API traffic; encryption for sensitive database fields and protected local device storage; an audit trail across user, transaction, reversal, sync, configuration and administrative events; hardened workstations with restricted peripherals; encrypted or access-restricted backups; and a controlled release process with rollback planning.
What happens if there is a security incident?
We identify and record it, contain the affected account, device or service, assess the data, operational, legal and regulatory impact, notify Anlo's authorised contact and agree any external notification path, then recover service, preserve evidence and complete a post-incident review for material incidents.
Delivery & acceptance
How is the project run?
Eight phases: kickoff and governance, discovery and requirements, solution design, build and configuration, integration testing, user acceptance testing, deployment and go-live, then hypercare before transition into managed service.
What has to be true before you call it done?
Agents can look up invoices and record cash, card and mobile money payments with three-copy receipts; the system keeps operating locally through an internet or VPN outage and syncs on restore; and reconciliation, per-agent summaries, channel tagging and exports all check out. Testing covers function, offline behaviour, security and reconciliation with representative agent workflows before go-live.
How are changes handled?
We identify the change and the business reason, classify it as an in-scope clarification, a defect correction or a new requirement, estimate the impact on cost, timeline, risk, training, security and support, then obtain written approval before implementing anything affecting agreed scope, timeline or commercial terms.
What Anlo provides
Hardware and environment
The local server machine, agent laptop, dot matrix printer and POS devices, plus reliable power, network equipment and printer supplies.
Connectivity and access
VPN setup and credentials between the site and Apex Bank from bank IT, diagnostic-centre API documentation or database access for invoice lookup, and the POS provider's integration interface where available.
People and agreements
Named technical and operational contacts at the bank and the centre, available for planned maintenance verification — and a formal data-sharing agreement between the bank and the diagnostic centre, in place before go-live, covering patient PII scope, purpose, security and retention.
Operational discipline
Users must not share credentials, and only authorised staff should access the system. Tell us in advance about network, firewall, database, operating system or hardware changes, planned site closure or an institutional system upgrade, so we can plan around them.