Catchup Applications KG

Indoor Navigation and Digital Wayfinding for Hospitals

Indoor navigation and digital wayfinding for hospitals that helps patients, visitors, and staff find locations quickly and reliably. This reduces missed appointments, lowers pressure on frontline staff, and improves the overall patient experience. Delivered as UK/EU-hosted SaaS. No personal data is processed or stored.

Features

• Real-time indoor navigation for patients, visitors, and staff
• Seamless integration with hospital websites and patient portals
• QR code-based route generation at reception desks
• Facility management support for maintenance and building analysis
• UK/EU-hosted SaaS with anonymized usage data only
• Multilingual support

Benefits

• Reduces patient delays, improving on-time arrivals and satisfaction
• Decreases staff interruptions for directions and wayfinding assistance
• Enhances visitor experience, especially for first-time users
• No personal data processed, ensuring privacy and compliance
• Optimizes facility management with data-driven building insights

• Education pricing available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at info@catchup-apps.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

166096272129155

Contact

Fiona Hackmann
+491706815232
info@catchup-apps.com

About the service

• Service categories:
  • Applications
    • Production and operations
      • Service industry and public sector operations
        • Healthcare
• Multi cloud support: No

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: Our service extends hospital websites, patient portals, and facility management systems, benefiting both patients and employees. Patients access seamless navigation via portals; staff gain logistic efficiencies through legacy HIS and facility tool integrations. EU/UK-hosted, it enhances existing workflows, reduces interruptions, and improves experiences all while ensuring data privacy.
• Cloud deployment model: Public cloud
• Service constraints: Network Requirements (Bluetooth Only): For Bluetooth-based indoor positioning, a stable BLE infrastructure is needed; Wi-Fi-based navigation does not have this requirement.; Integration Lead Time: Custom integrations with legacy systems may require additional setup time.; Device Compatibility: Best experienced on modern browsers and mobile devices (iOS/Android).; Data Privacy: Only anonymized, aggregated usage data is processed
• System requirements:
  • QR Code Generation: Tablet at reception with internet access
  • Indoor Positioning: BLE signals
  • Floor Plans: DWG, PDF, or GeoJSON of building layouts

User support

• Email or online ticketing support: Yes
• Support response times: Monday-Friday we respond to questions that are not classified as an operational disruption within the hour.
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Our support is tiered to address issues based on severity, ensuring rapid response and resolution:; ; Critical Issues:; Problems causing complete service outages (e.g., system downtime) receive a response within 2 hours and are resolved or mitigated within 48 hours.; ; Major Issues:; Significant disruptions that impair core functionality but don’t fully halt operations are addressed with a 4-hour response time and restored within 64 hours.; ; Minor Issues:; Low-impact problems receive a response within 8 hours, with full resolution within 96 hours.; ; Reaction Time refers to the initial acknowledgment and investigation start by a human, while Restoration Time guarantees a fix or workaround within the specified window. Support is available through dedicated channels (e.g., ticketing, phone, or email) during business hours, with escalation paths for urgent matters.; ; This approach aligns with our commitment to reliability and customer satisfaction, ensuring minimal disruption to hospital operations. For G-Cloud buyers, this means predictable, transparent support tailored to the critical nature of healthcare environments. All response and resolution times are measured in calendar hours, and our team prioritizes issues based on their operational impact.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: The process begins with a collaborative kickoff meeting, where we align with the customers team on project goals, timelines, and responsibilities. This session clarifies roles and sets clear expectations, fostering a shared understanding of what we aim to achieve together.; To empower the staff, we provide comprehensive online training for our service interface. This training covers all essential features such as managing points of interest, pathways, and accessibility alerts so the team can confidently navigate and utilize the system.; ; For flexibility, we also offer a detailed knowledge base, filled with step-by-step videos, use-case examples, and answers to frequently asked questions. This resource is designed to support both initial learning and ongoing reference, ensuring users can quickly find solutions to common challenges.; ; For larger or more complex implementations, we can provide customized onsite training or workshops to address specific needs.
• Service documentation: Yes
• Documentation formats: PDF
• Documentation accessibility standard: EN 301 549
• End-of-contract data extraction: When a contract concludes, users retain full access to their digital building model, which can be extracted in a standard, reusable format. Additionally, all information related to points of interest (such as locations, details, and metadata) and usage statistics can be exported as CSV files, ensuring seamless continuity for your facility management and analysis needs.
• End-of-contract process: Once the data transfer is complete, all remaining data is permanently deleted from Catchup Applications’ systems.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
  • Other
• Application to install: Yes
• Compatible operating systems:
  • Android
  • IOS
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: There are no functional differences between our mobile and desktop services—both provide the same core features, including real-time indoor navigation, QR code-based wayfinding, and integration with hospital systems. The primary distinction lies in ease of use and context of access.
• Service interface: Yes
• Description of service interface: Service Interface Description; Our intuitive service interface empowers users to manage all aspects of indoor navigation and wayfinding. Users can effortlessly control points of interest, editing details such as images, descriptions, and opening hours. The interface provides comprehensive user statistics, offering insights into navigation patterns and engagement. It also allows real-time management of pathways, including marking blockages or construction zones to ensure accurate routing. A unique validation feature alerts users if a blockage impacts accessibility for individuals with barrier-free needs, guaranteeing inclusive navigation.
• Accessibility standards: None or don’t know
• Description of accessibility: The service is designed for broad usability, with clear layouts, intuitive navigation, and configurable options such as adjustable font sizes and brightness. These features support users with visual sensitivities and varying levels of digital confidence. While full compliance with formal accessibility standards such as WCAG or EN 301 549 is not yet in place, accessibility considerations are embedded in our design approach. Formal testing with assistive technologies and alignment with recognised standards form part of our planned improvement roadmap.
• Accessibility testing: While we have not yet performed formal testing with users of advanced assistive technologies (e.g., screen readers, Braille displays, or voice navigation tools), we recognize this as a critical next step.
• User support accessibility: EN 301 549
• API: Yes
• What users can and can't do using the API: Our mature API enables seamless integration of our digital wayfinding and indoor navigation into third-party systems. Users can programmatically set up and manage services via RESTful endpoints, supported by comprehensive SDKs for major platforms.; Setup & Management:; ; Load POIs: Retrieve a full list of Points of Interest (POIs) including UUIDs and URLs for direct integration into your systems.; Dynamic Updates: Modify POIs, routes, and building layouts in real-time via API calls, ensuring your data stays current.; Events & News: Push updates or announcements to digital displays or apps, keeping users informed.; SDKs: Pre-built SDKs simplify integration into web, mobile, or kiosk applications, reducing development time.; Limitations:; ; BLE Senders: Configuration and management of BLE beacons are handled via our admin dashboard (not the API) to ensure network stability and security.; Map Access: While you can embed interactive maps in third-party apps, base map data and styling are managed by Catchup to maintain consistency and accuracy.; For Developers: Full API documentation, versioned endpoints, and sandbox environments are available. Our team provides dedicated support for enterprise integrations. This enables NHS digital teams and suppliers to embed wayfinding directly into existing portals, apps, and kiosks without duplicating data or maintaining parallel systems.
• API documentation: Yes
• API documentation formats: PDF
• API sandbox or test environment: No
• Customisation available: Yes
• Description of customisation: What can be customised:; Visual Design: Hospitals can personalise the look and feel of the digital maps and interfaces to align with their branding, including colours, logos, and fonts.; Content & Wayfinding: Users can define points of interest (e.g., departments, amenities, or emergency routes), update room names, and adjust navigation paths to reflect real-time changes in the building layout.; User Roles & Permissions: Facility managers can set access levels, allowing staff to generate QR codes for patient routes (via Infoway) or restrict editing rights to authorised personnel.; Integration: The system integrates with hospital websites, patient portals, and legacy systems, enabling seamless data flow and custom workflows.; Multilingual Support: All interfaces and instructions can be localised to support diverse patient populations.; How users can customise:; Customisation is managed through an intuitive admin dashboard. Facility managers or IT staff can update maps, routes, and content without technical expertise. For deeper integrations or design changes, our team provides support to ensure smooth implementation.; Who can customise:; Hospital Staff: Authorised personnel (e.g., facility managers or IT teams) handle day-to-day updates, such as adding new destinations or adjusting routes.; ; We assist with initial setup, complex integrations, and advanced customisations to align with hospital-specific requirements.

Scaling

• Independence of resources: We prevent noisy-neighbor impact by isolating, scaling, and prioritizing. Traffic hits a WAF/load balancer that spreads bursts; autoscaling and capacity management maintain headroom. Services are isolated by subnets and strict rules to limit blast radius. Continuous monitoring alerts us before customers feel issues. If demand turns volumetric, a DDoS runbook preserves core SLOs and coordinates upstream help. Business-critical services have defined MTAs, with recovery playbooks to re-provision compute and databases and restore from redundant backups. We strengthen guarantees with per-tenant rate limits, explicit autoscaling/SLO thresholds, and regular load/failover tests with evidence. Result: sustained availability regardless of other users’ spikes elsewhere.

Analytics

• Service usage metrics: Yes
• Metrics types: Navigation Performance: Route calculations, usage frequency, and QR code engagement, popularity of destinations, search words used and more.; Accessibility: Alerts for pathway blockages affecting barrier-free routes.; ; System Reliability: Uptime, integration success, and anonymized usage data.
• Reporting types:
  • Real-time dashboards
  • Reports on request
• Resource tagging: Yes
• FOCUS resource tagging: No

Supplier type

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Staff screening not performed
• Government security clearance: None

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: European Economic Area (EEA)
• User control over data storage and processing locations: No
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Physical access control, complying with another standard
  • Encryption of all physical media
• Data sanitisation process: Yes
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Data Erasure
  • Explicit overwriting of storage before reallocation / Secure Erase
  • Physical Destruction / Hardware containing data is completely destroyed
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

• Data export approach: We do not store or process personal user data. Hospitals, as our clients, retain full ownership and control of their digital building models and destination information. They can export this data at any time via CSV format, enabling seamless integration with their existing systems or for internal analysis.
• Data export formats:
  • CSV
  • Other
• Other data export formats: GeoJSON, IFC
• Data import formats:
  • CSV
  • Other
• Other data import formats: GeoJSON

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • TLS (version 1.2 or above)
  • Other
• Other protection between networks: Home/remote networks must use WPA3 where possible.
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • Other
• Other protection within supplier network: Network segregation (per-product subnets, security groups, strict port rules), WAF at the edge, and monitored network services. WLAN uses WPA3 where applicable

Availability and resilience

• Guaranteed availability: We guarantee an availability of 99,9%. The customer is reimbursed through a reduction of the ongoing licence in accordance to the downtime.
• Approach to resilience: Our service is engineered for fault tolerance and rapid recovery. The platform uses network segmentation and least-privilege access; external services are fronted by load balancer/WAF, and administrative access is gated via VPN/SSH with IP/port controls. We operate formal change/configuration processes with event logging and review.; ; Data resilience: all critical workloads are backed up automatically at the hosting provider with tested restore runbooks for application servers and databases. Where appropriate, we maintain secondary copies (e.g., Microsoft 365 backups on an office NAS) to support export and recovery. Source code is versioned and can be re-provisioned from cloud artefacts to avoid single points of failure. Capacity management and time synchronisation are enforced for performance and forensic integrity.; ; Datacentres: we host in certified facilities (ISO 27001, BSI C5, SOC 2/3, EN 50600). Detailed DC topology (regions/zones, inter-DC links), service RPO/RTO by system, backup storage classes and recent restore-test results are available on request.; ; Mapping to Principle 2: we address location/jurisdiction via certified DCs; physical and operational resilience through accredited facilities and robust ops; protection of data at rest via backups and controlled access; and sanitisation/disposal via documented procedures (details available on request).
• Outage reporting: We detect outages via defined system monitoring: high-criticality systems must generate and be analyzed for event logs.; ; When an outage is detected or reported, we open an incident in ClickUp (our incident register) and coordinate via our ISMS processes.; ; Internal escalation & comms; • Primary channels are mobile/phone, messaging, and email in that order so coordination continues even if one channel is down.; • The Managing Director (Geschäftsführung) is responsible for deciding if/when external communication is required.; ; Customer reporting; • If a customer is (or might be) impacted, we notify designated contacts using approved channels (email/phone/messaging) and continue updates until resolution.; • After successful recovery, we proactively inform the customer that service has been restored.; ; Records & follow-up; All actions, decisions, and timelines are recorded in the ClickUp incident ticket and retained in our Digital Compliance Office (DCO).; We review incidents during ISMS activities (audits, KPIs, management review) to improve communication and resilience.

Identity and authentication

• User authentication needed: No
• Access restrictions in management interfaces and support channels: Management interfaces and support channels are restricted by least-privilege, MFA and network controls. Admin access is granted only to named roles via SSO with conditional access (device compliance, geo/IP, risk signals) and time-bound elevation (JIT/PAM). Interfaces are not exposed publicly; access requires VPN or bastion with IP allowlists and strong SSH. Support tools (ticketing, remote assistance, logs) use SSO, MFA and role-based permissions; customer data is redacted-by-default and access is session-recorded. All actions are logged to a central SIEM; high-risk events create alerts. Access reviews run quarterly and on role changes; dormant privileges are removed automatically and verified by audits.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Dedicated link (for example VPN)
  • Other
• Description of management access authentication: Just-in-time privileged access (PAM), conditional access (device compliance, risk/geo), and session logging for all admin actions

Audit information for users

• Access to user activity audit information: Users receive audit information on a regular basis
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users receive audit information on a regular basis
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Software Security Code of Practice: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: We operate an ISMS with documented policies covering operations & change management, configuration, backups, logging and network security. Changes are ticketed in ClickUp, risk-assessed by asset owners, approved/released by IT leadership, and recorded (incl. minor vs. hotfix handling). Configuration, backup testing and security log reviews are maintained as formal records.; ; Business continuity is governed by our BCP annex with scenario playbooks and an OTC recovery plan; responsibilities and prerequisites (contacts, documents, backups) are defined and executed via the ticketing process.; ; The Information Security Officer (ISB) owns the Information Security Policy, reviews it at least annually, and evaluates effectiveness based on audit results, KPIs, management reviews and corrective actions.; The IT Lead manages and monitors network security and services; Product Owners and the IT Lead are accountable during recovery.; ; Management approves a rolling three-year internal audit program; audits are planned risk-based, executed against defined criteria, and results (incl. nonconformities) are reported to top management.; All ISMS documents and evidences are controlled in our Digital Compliance Office (DCO); policies are updated based on audit findings, KPIs, management reviews and corrective actions.; ; This governance ensures policies are owned, changes are controlled, continuity is tested, and compliance is verified end-to-end.

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Configuration and change management are governed by our ISMS. Components are recorded in an asset/CMDB with unique IDs, owners, classification and dependencies; status changes (onboard, in-service, patched, retired, sanitised/disposed) are logged, with version control for code/IaC and MDM for endpoints. Changes follow a ticketed RFC workflow (standard/normal/emergency): scope, rationale, affected assets, dependency/availability analysis, security impact assessment (confidentiality, integrity, availability, privacy, threat/vuln, data flows), rollback plan, and test evidence. Risk-ranked approvals (peer review, info security, management/CAB for high risk) are required. Implementation uses least-privilege, maintenance windows and segregation of duties. Post-change validation, monitoring and PIRs complete the lifecycle.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Vulnerability management is risk-based and continuous. We maintain an asset inventory/CMDB and run authenticated scans on servers, containers and endpoints; code and third-party packages are checked by SCA/CI. Findings are triaged using CVSS, exploitability (e.g., CISA KEV), exposure, and business impact; threat-model reviews cover new/changed services. Patching targets: internet-facing critical within 72 hours, other critical/high within 7 days, medium within 30 days, low/best-effort during maintenance. Compensating controls (WAF, config changes) are applied if patching must be deferred. Sources include vendor advisories, NCSC and CISA alerts, NVD/CVE feeds, scanner intelligence, and mailing lists; we track exceptions and verify fixes with rescans.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: We operate layered protective monitoring across cloud, network, endpoints and apps. Logs (auth, admin, network, DB, OS, EDR, WAF) stream to a central SIEM with correlation rules, anomaly baselines and threat-intel (CISA/NCSC, vendor feeds). Potential compromises are flagged via high-fidelity alerts (e.g., impossible travel, MFA failures, lateral movement, suspicious child processes). On alert, we triage, preserve evidence, isolate impacted assets, block indicators, reset credentials/keys, and start incident handling with communication and regulatory checks. Response targets: Critical—triage ≤30 minutes, containment ≤4 hours; High—same business day; Medium—5 business days; Low—planned maintenance. Post-incident reviews tune detections and harden controls.
• Incident management type: Supplier-defined controls
• Post-quantum cryptography secure: Yes
• Incident management approach: We maintain predefined runbooks for common events (ransomware, connectivity loss, DDoS, system failure) covering containment, provider escalation, and customer communications. Staff, suppliers, and partners report suspected vulnerabilities or incidents via our service desk; every report is logged in the ClickUp incident register and triaged. On potential compromise, we preserve evidence, isolate affected assets, block indicators, rotate credentials/keys, and engage cloud/ISP partners as needed. Significant incidents trigger stakeholder notifications and written incident reports detailing timeline, root cause, impact, indicators, actions taken, and corrective actions. Records are controlled under the ISMS, and post-incident reviews drive improvements to monitoring, runbooks, and preventive controls.

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 5%
• Between £250,000 and £500,000: 5%
• Between £500,001 and £1,000,000: 7%
• Between £1,000,001 and £2,500,000: 10%
• Between £2,500,001 and £5,000,000: 12%
• Over £5,000,001: 15%

Standards and certifications

• ISO/IEC 27001 certification: Yes
• ISO/IEC 27001 accredited by: DEKRA Certification GmbH
• ISO/IEC 27001 accreditation date: Thursday 28 November 2024
• What the ISO/IEC 27001 doesn’t cover: Everything is covered
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber Essentials Certificate Number: Provided
• Cyber essentials plus: No
• Cyber Essentials Alternative: None of the criteria
• Other security certifications: No

Social value

• Mission: Build an NHS fit for the future:

  That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

  Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

  • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
  • Understanding barriers to access to health and social care services or employment opportunities e.g. digital inclusion

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at info@catchup-apps.com. Tell them what format you need. It will help if you say what assistive technology you use.