BITJAM LIMITED

Digital Health Platform Development and Support

Bitjam delivers secure, compliant digital health software, medical devices and data-driven clinical trial platforms, including UKCA-ready health applications. Our specialist clinical experienced team partners with NHS organisations and academic researchers to design, develop and host user-centred solutions aligned with UK regulatory, DTAC and clinical safety requirements.

Features

• Secure, cloud-hosted digital health platforms built for NHS requirements
• Web and mobile access via browser, native or hybrid apps
• Specialist clinical and technical expertise for NHS implementation
• Real-time data capture, reporting and performance dashboards
• Role-based access controls, audit logging and MFA security
• Automated onboarding, reminders and follow-up workflows
• Multimedia content delivery including video, audio and interactive modules
• REST API integrations including NHS Login and messaging services
• Multi-language localisation with WCAG 2.1 AA accessibility
• ISO 27001 hosting, UK/EU encryption and DCB0129 safety documentation

Benefits

• Deploy secure digital health platforms quickly using reusable components
• Scale services without increasing clinician time or workload
• Provide secure access to remote therapy for patients and clinicians
• Automate onboarding, reminders and outcomes tracking
• Monitor engagement and patient outcomes in real time
• Standardise intervention pathways across teams and services
• Support blended digital care models that reduce NHS pressure
• Co-design with clinicians and lived-experience contributors
• Enable multi-site, multi-language deployment across regions
• Protect health data with ISO 27001 hosting and encryption

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at carl@bitjam.org.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

340125190428618

Contact

Carl Plant
01782 454304
carl@bitjam.org.uk

About the service

• Service categories:
  • Application Development and Deployment
    • Application development
      • Software construction components
        • Software construction components
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: Some integrations (e.g. NHS Login or third-party APIs) require prior technical and security approval from the buyer’s organisation.; ; High-risk clinical decision-making functions are excluded; the platform provides assistive digital support only.; ; Custom feature requests or large-scale localisation may affect delivery timelines.; ; Data hosting is within UK/EU AWS regions unless otherwise agreed.; ; Internet access is required, and system performance depends on supported devices and browsers.; ; Planned maintenance windows will be scheduled in advance and communicated to the buyer.; ; Third-party services or API providers may impose their own usage limits or service dependencies.
• System requirements:
  • Desktop, laptop, tablet, or smartphone with up-to-date OS
  • IOS 14+ or Android 10+ for mobile app access

User support

• Email or online ticketing support: Yes
• Support response times: P1 – Critical 1 hour 4 hours; P2 – High 1 business day; P3 – Medium 1 business day ; P4 – Low / Request General enquiry, 2 business days
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AA
• Phone support: No
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: We provide tiered support designed for digital health and research environments, available via email and ticketing during UK business hours (Monday–Friday, 09:00–17:00).; All support includes secure incident handling, monitoring, and access to Bitjam’s technical team.; ; We provide standard (1 day) and enhanced (4 hour) support.
• Support available to third parties: No

Onboarding and offboarding

• Getting started: Full co-production with the software development lifecylce, including training.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• Documentation accessibility standard: WCAG 2.2 AAA
• End-of-contract data extraction: Either via data downloads or data export request.
• End-of-contract process: Review of extension, hibernation or decommission.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Chrome
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Depends on case by case. With some interventions we develop a mobile app for patients to use and web based clinical platforms.
• Service interface: No
• User support accessibility: WCAG 2.2 AAA
• API: No
• Customisation available: Yes
• Description of customisation: Fully scoped bespoke applications can be design and developed.

Scaling

• Independence of resources: AWS auto scaling, regular monitoring of capacity, capacity early warnings system.

Analytics

• Service usage metrics: Yes
• Metrics types: Bespoke usage data can be collected, stored and reported.
• Reporting types: Regular reports
• Resource tagging: Yes
• FOCUS resource tagging: No

Supplier type

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Physical access control, complying with SSAE-18 / ISAE 3402
• Data sanitisation process: Yes
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Data Erasure
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

• Data export approach: Either manually or via request
• Data export formats: CSV
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: Our platforms are designed for high availability and resilience, hosted on AWS across multiple availability zones within the UK/EU.; ; Guaranteed availability: 99.5% uptime measured monthly, excluding planned maintenance and agreed downtime.; ; Typical uptime achieved: >99.9% across production environments.; ; Planned maintenance: Conducted outside UK business hours with prior notice (minimum 48 hours).; ; Monitoring: Continuous 24/7 monitoring and automated alerting.; ; Disaster recovery: Multi-region replication, automated backups, and tested recovery procedures.
• Approach to resilience: Our service is designed with multiple layers of resilience to ensure continuous operation and data protection.; ; Cloud infrastructure: Hosted in AWS UK/EU regions with built-in redundancy across multiple availability zones.; ; Failover and redundancy: Application and database components are replicated to support rapid recovery in the event of a zone or system failure.; ; Automated backups: Encrypted daily backups stored in geographically separate locations, regularly tested for restoration.; ; Load balancing and autoscaling: AWS services automatically distribute traffic and scale resources to maintain performance.; ; Monitoring and alerting: Continuous health checks with automated alerts to the operations team for rapid response.; ; Disaster recovery: Documented and tested DR plan aligned with ISO 27001 and NHS DSP principles.; ; Physical resilience: AWS data centres provide N+1 redundancy across power, networking and cooling.; ; Business continuity: Bitjam maintains a tested Business Continuity Plan to ensure continuity of support and service delivery.; ; Detailed data centre configuration and resilience documentation are available to authorised buyers on request.
• Outage reporting: Our service uses an internal monitoring and escalation process to identify and respond to outages quickly.; ; Continuous monitoring automatically triggers email alerts to the Bitjam support and operations team.; ; Confirmed outages are escalated through a secure internal messaging system to ensure rapid response, including out-of-hours escalation when required.; ; Customers are notified of any confirmed service disruption by email as soon as practical, including details of the impact, mitigation steps and estimated resolution time.; ; Progress updates are shared directly with affected customers until normal service is restored.; ; A post-incident summary is provided after resolution, outlining the root cause and corrective actions.; ; We do not currently operate a public status page or API; outage communication is handled directly with contracted customers through secure channels.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password
• Access restrictions in management interfaces and support channels: Access to all management interfaces and support systems is strictly role-based and limited to authorised Bitjam personnel. Administrative and production environments use multi-factor authentication, unique user accounts and least-privilege permissions managed through AWS Identity and Access Management (IAM). Access requests require management approval and are logged within the ISMS. Support channels (email and ticketing) are restricted to verified customer contacts and use encrypted communication. All access activity is logged, monitored and reviewed regularly to detect unauthorised actions. Privileged access is time-bound and removed immediately when staff change role or leave the organisation.
• Access restriction testing frequency: At least every 6 months
• Management access authentication: Multi-Factor Authentication (MFA)

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Software Security Code of Practice: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: Bitjam operates an Information Security Management System (ISMS) certified to ISO/IEC 27001:2022, covering all services, staff and infrastructure. Policies include Information Security, Access Control, Data Protection and Privacy, Incident Management, Business Continuity, Supplier Security and Acceptable Use. These define how data is protected, accessed and monitored within our organisation and cloud environments.; ; The Managing Director acts as Information Security Officer, supported by a Security Committee comprising technical and administrative leads. The committee reviews risks, incidents and control performance quarterly. All staff complete annual security and data-protection training, sign confidentiality agreements and follow least-privilege access principles with multi-factor authentication.; ; Security incidents are logged, investigated and reported through the ISMS, with corrective actions tracked to closure. Controls are reviewed through internal audits and verified by independent ISO 27001 surveillance audits. Supplier compliance (AWS, MongoDB Atlas, Mailgun, etc.) is maintained through contractual assurance and evidence of certification.; ; Policies are published internally, version-controlled and reviewed annually or following significant change. This structure ensures consistent governance, risk management and compliance with UK GDPR, NHS DSP Toolkit expectations and government security principles.

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: Bitjam follows formal configuration and change-management processes defined within our ISO/IEC 27001:2022-certified ISMS, aligned with CSA CCM v4.0 and SSAE-18 / ISAE 3402 (SOC 1 & 2) principles.; ; All configuration and software changes are:; ; Logged and tracked through Bitjam’s internal issue-management system (Jira).; ; Assessed for security, privacy and operational impact before approval.; ; Reviewed and authorised by a Technical Lead or the Managing Director prior to deployment.; ; Deployed through version-controlled repositories and automated CI/CD pipelines to ensure reproducibility and rollback.; ; Tested in separate staging environments before production release.; ; Monitored and documented with audit trails for traceability and accountability.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: Bitjam follows a formal vulnerability-management process within its ISO 27001:2022 ISMS. Potential threats are identified through continuous monitoring, automated security scans, AWS Security Hub alerts and vendor advisories (AWS, NCSC, MITRE, OWASP). Vulnerabilities are risk-assessed based on severity and potential business impact. Critical patches are applied within 24 hours, high-risk within 72 hours and medium/low during the next scheduled release. All changes follow approved configuration-control procedures and are tested before deployment. Threat intelligence is obtained from trusted sources including NCSC advisories, AWS security bulletins, CERT-UK and industry feeds, ensuring timely mitigation and alignment with government Operational Security Principle 5.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: Bitjam maintains a protective-monitoring process aligned with ISO 27001:2022. All systems are continuously monitored through AWS CloudWatch, GuardDuty and Security Hub for signs of compromise or abnormal activity. Automated alerts trigger an immediate review by the technical team. Logs from servers, applications and authentication systems are securely aggregated and retained for forensic analysis.; ; When a potential compromise is identified, an incident ticket is raised within the ISMS and containment actions begin within one hour. The Information Security Officer coordinates investigation, root-cause analysis and reporting. Confirmed incidents follow our formal incident-response plan, including customer notification, mitigation and post-incident review.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Post-quantum cryptography secure: Yes
• Incident management approach: Bitjam operates a formal incident-management process within its ISO 27001:2022 ISMS. Pre-defined procedures exist for common events such as service outages, data breaches and unauthorised access. Incidents are logged, categorised and prioritised through our secure ticketing system.; ; Users can report incidents by emailing the Bitjam support address or through an assigned project contact. Reports are acknowledged within one business hour and escalated to the Information Security Officer for coordination.; ; Following resolution, a detailed incident report is issued to affected customers, outlining root cause, impact, actions taken and preventive measures. Lessons learned are reviewed in quarterly security meetings.

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 5%
• Between £250,000 and £500,000: 5%
• Between £500,001 and £1,000,000: 5%
• Between £1,000,001 and £2,500,000: 5%
• Between £2,500,001 and £5,000,000: 10%
• Over £5,000,001: 10%

Standards and certifications

• ISO/IEC 27001 certification: Yes
• ISO/IEC 27001 accredited by: Alcumus ISOQAR Limited
• ISO/IEC 27001 accreditation date: Thursday 11 September 2025
• What the ISO/IEC 27001 doesn’t cover: Medical device development which is covered by our internal QMS. We plan to gain ISO 13485 certification.
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber Essentials Certificate Number: 4c9cc61d-9482-47d5-893e-7baf06347343
• Cyber essentials plus: Yes
• Cyber Essentials Plus Certificate Number: F5be42d1-8953-4cbd-a073-b7fde2f1c7df
• Other security certifications: No

Social value

• Mission: Build an NHS fit for the future:

  That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

  Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

  • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
  • Understanding barriers to access to health and social care services or employment opportunities e.g. digital inclusion
  • Inclusive and accessible recruitment practices, development practices and retention policies that support-focused activities including those provided in the Guide for line managers on recruiting, managing and developing which support people with a disability or health condition
  • Actions to invest in the physical and mental health and wellbeing of the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at carl@bitjam.org.uk. Tell them what format you need. It will help if you say what assistive technology you use.