For procurement teams

Procurement evidence pack

Everything your procurement committee, IT leadership, compliance officer, and clinical director need to evaluate MediCare HIS. Seven documents, each readable on this site or downloadable as a PDF. Nothing here requires an NDA. Verify our claims, share them with your committee, and bring the questions to a 30-minute call.

The seven documents

What your committee will need

Each document is structured so a senior decision-maker can read it in under 10 minutes and a junior analyst can verify the underlying claims in detail.

Brochure

4-page company and product overview. Who we are, what MediCare HIS does, the 50+ clinical + HR modules, deployment options, pricing summary, and how to start. The document to circulate at a procurement-committee opening meeting.

Read brochure →

Security whitepaper

Threat model, controls by domain (identity, transport, data, monitoring, incident response), verification methods your IT team can run independently, and our standards-alignment posture. Companion to the public Trust page at /security.

Read security whitepaper →

Deployment architecture

Three deployment options — cloud, on-premise, per-hospital server install — with the underlying architecture for each. Sub-processor diagrams, network requirements, hardware specifications, and tenant isolation.

Read deployment architecture →

Compliance roadmap

Current state and trajectory against ISO 27001:2022, ISO 27799 (healthcare), AICPA SOC 2 Type II, NHS Data Security & Protection Toolkit. DPA framework, sub-processor list, cross-border data transfer mechanisms.

Read compliance roadmap →

Service Level Agreement

Uptime targets by tier, RPO/RTO commitments, response-time matrix by severity, incident-communication SLAs, maintenance-window policy, disaster-recovery guarantees, and remedies if we miss them.

Read SLA →

Support model

Channels (email, phone, WhatsApp, in-portal), hours of coverage, response-time guarantees by severity and pricing tier, escalation path, included training, and the on-call posture today and at each stage of company growth.

Read support model →

Onboarding methodology

Six-phase implementation playbook from kickoff through stabilisation. Typical timelines for clinics, mid-size hospitals, and teaching hospitals. What we do, what your team does, the data-migration approach, and the hypercare model.

Read onboarding methodology →

Comparison — GHIMS vs MediCare HIS

For Ghana facilities evaluating both. Honest segment-fit comparison, transparent acknowledgement of where GHIMS has the advantage today, and the differentiators MediCare HIS brings to private, mission, and teaching hospitals.

Read comparison →

How to download

Each document is downloadable as a PDF

Every page above has a print-optimised layout. Open any page, hit ⌘P (Mac) or Ctrl+P (Windows / Linux), select "Save as PDF" as the destination, and the document saves with a clean A4 layout — no navigation chrome, no signin modal, links rendered with their full URLs.

For procurement-committee distribution, we suggest sharing the link to this page so the committee can access the latest version. The pages are version-controlled and updated as our compliance state evolves — a PDF saved today reflects today's posture; the live page reflects the current posture. The change log on each page tracks updates.

What's NOT in this pack

Customer-specific documents need a conversation

A few documents your procurement team will need are customer-specific and don't make sense as static publications:

Master Services Agreement (MSA) and Data Processing Addendum (DPA) — drafted per-customer to reflect your jurisdiction, data-residency requirements, and tenancy model. Available within 48 hours of the first qualifying call.
Business Associate Agreement (BAA) — for US-touching customers requiring HIPAA-style obligations. Same 48-hour turnaround.
Insurance certificates — professional indemnity and cyber-liability coverage details shared under NDA at the contract stage.
SOC 2 Type II report — Stage 3 capability per our compliance roadmap; not yet available. The trajectory and current-state evidence are in the compliance-roadmap document above.
Penetration test report (full version) — first engagement scheduled. Redacted summary will be available; full report shared with active customers under NDA per our incident-response policy.
Customer references — initial launch-partner cohort being onboarded; reference calls available to qualified prospects on request.

Honest stage disclosure

We're transparent about where we are

MediCare HIS is in its first wave of paying customers. We disclose this because procurement teams should know what they're buying:

What we have: a complete 50+ module HIS (clinical + operations + the full HR / workforce stack), three deployment options, hourly automated backups with 7-year off-host immutable storage, multi-channel critical-alert pipeline, security and compliance posture documented under NDA, transparent pricing. Standards conformance verifiable at /standards.
What we're building toward: SOC 2 Type II certification, formal ISO 27001 certification, a Ghana-based implementation team, 24/7 SOC partnership. Each has a date in the compliance roadmap.
What we're honest about not having: hundreds of customer-years of operational miles, an established multi-country support team, a published customer-reference list. We're early. We tell you that up front so the decision is informed.
The risk-mitigation we offer: 24-hour self-serve trial extending to 90 days on real data with full feature access, direct-to-founder support during the first six months of any deployment, and a written, itemised quote within 48 hours of an intro call.

Integration checklist (what your IT director will ask)

The boxes already ticked

Procurement IT reviews typically gate on the items below. Each is shipped and verifiable today — no "will integrate" line items, no professional-services scope.

Single Sign-On (OIDC) — Microsoft 365 / Azure AD / Google Workspace / Okta / Auth0. Group-to-role mapping. JIT user provisioning. Hardened id_token verification with a strict algorithm allow-list. Configure at Settings → Authentication.
FHIR R4 — read AND write — Patient, Encounter, Observation, MedicationRequest, AllergyIntolerance, Condition. Bearer-key auth, tenant-scoped. CapabilityStatement at /fhir/metadata. Curl-verifiable from your meeting room.
HL7 v2.5 — inbound MLLP listener for ORU^R01 (results) and ADT^A01/A04/A08 (admit / register / update). Outbound ORM^O01 for orders to your existing analysers. ACK^R01 round-trip. Plug-and-play with Sysmex / Cobas / Mindray.
Coding standards — ICD-10, SNOMED CT, LOINC, RxNorm, UCUM. NHIS member identifier and DHIMS2 reporting native.
Audit + reporting — hash-chained audit log mirrored off-host (7-year retention, immutable). Per-control evidence inventory shared with your auditor under NDA.
Multi-tenant isolation — every row carries a hospitalId; every query and notification fan-out filters by tenant. Cross-tenant lookups return 404, not "exists but forbidden".
Configurable clinical decision support — your CMO writes safety rules at Settings → Clinical policies. No code change. Audited.

Every claim above is verifiable in 30 seconds with curl https://<your-tenant>.medicarehis.com/standards. We'll happily walk through the verification on a call.