IPLATO HEALTHCARE LIMITED

iPlato Community

The Community bundle is designed for outpatient clinics, community healthcare settings and extended hour’s services and comprises of iPLATO’s Connect (e.g. two-way messaging, batch messaging, campaign messaging) and iPLATO Toolbar (e.g. video calls, video consultations, messaging with file attachments).

Features

• Secure bi-directional communication via SMS, NHS App, myGP app
• Import patients, select from a group, or add contacts manually
• Contact patients individually or in bulk
• Allow patients to reply with keywords that trigger automated processes
• Initiate remote video consultations directly from the clinical system
• Save a complete record of patient interaction to the EPR
• Send two customisable automatic appointment reminders in different languages
• Send prebuilt questionnaires or use our bespoke questionnaire building service
• Automatic prioritisation of patients in need of urgent care
• Schedule messages to send at a future date or time

Benefits

• Free up appointments and reduce DNAs with automatic cancellations
• Save to the clinical system providing a clinical audit trail
• Transforms patient experience, enhance GP access, improve health outcomes
• Intuitive interface with simple setup, little to no training required
• Save costs with data messaging to myGP and NHS Apps
• Greater choice, messaging, video, and voice communication supports digital inclusivity
• Reduce administrative burden and processes
• 24/7 real-time dashboard available, holistic activity and spending overview
• Secure, cloud hosted, HSCN connected, GDPR compliant, ISO certified
• Autonomy to healthcare professionals, transforming the way patients are managed

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at sales@iplato.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

352745097583643

Contact

Commercial Team
020 3743 0060
sales@iplato.com

About your service

• Service categories:

  Applications

  Production and operations

  Service industry and public sector operations

  • Healthcare
  • Defence
  • Adult Social Care
  • Children's Social Care
  • Other
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: None
• System requirements:
  • Up to date internet browser
  • Webcam and microphones for video/audio calls

User support

• Email or online ticketing support: Yes
• Support response times: On average resolution is under 10 mins. We respond to; questions within agreed SLA
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Support hours 08:00 – 18:00 Monday – Friday Response times; are determined by priority. Support levels detailed below are; included within pricing and we provide first line support with; escalation to second line support if/when required. Priority 1:; Within 1 hour Priority 2: Within 2 hours Priority 3: Same day; Priority 4: Same day - acknowledgement and triaged. Out of; hours support: Out of hours 18:00 – 08:00 Monday – Friday.; Priority 1 Within 12 hours Priority 2 Within 12 hours Priority 3; Next working day Priority 4 Next working day
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: We run a 1-3 week training programme - this includes: -; Technical setup - 1-2-1 and group training webinars. - On-demand; support documentation and videos
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: If required, this can be requested from our first line support; team
• End-of-contract process: User data is deleted, no data record left behind
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
• Application to install: Yes
• Compatible operating systems: Windows
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: The web version is compatible with internet browsers that carry; 99% of all internet traffic (inc mobile browsers), and is written; as a responsive web platform to ensure optimum display across; screen sizes and devices/mobile.
• Service interface: No
• User support accessibility: WCAG 2.2 AA
• API: No
• Customisation available: Yes
• Description of customisation: The platform is highly customisable. - Sign-posting and user; flows. - Templates used

Scaling

• Independence of resources: All processing occurs on our multi-tier, AWS London; infrastructure, which is configured for elastic scaling in order to; handle peaks and troughs in usage,

Analytics

• Service usage metrics: Yes
• Metrics types: On-line dashboard and reports
• Reporting types:
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CHECK service provider
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Encryption of all physical media
• Data sanitisation process: Yes
• Equipment disposal approach: In-house destruction process
• Data sanitisation type: Deleted data can’t be directly accessed / Cryptographic Erasure

Data importing and exporting

• Data export approach: If a customer, user or patient requests a documented data; extract, we provide a structured CSV file detail all data that we; hold about them. Requests can be made directly to our first line; support team who operate on a 24 hour SLA if requests are; received between 9am - 5pm, Monday to Friday.
• Data export formats: CSV
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • Private network or public sector network
  • TLS (version 1.2 or above)
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

• Guaranteed availability: Guaranteed availability of 99.9% - this excludes planned; downtime for regular product releases and spot fixes. This is; communicated to customers well in advance. All product; releases are undertaken at the quietest period of usage and; typically are completed as "blue/green" deployments (i.e. no; downtime). No refund or credit scheme is currently in place.
• Approach to resilience: Housed in UK-based, multi-region, Tier 3 Data Centres for high; availability and resilience. Our range of products are utilised by; more than 2000 unique organisations UK wide, and uptime has; been stable at 99.9% for last 24 months. Our products are; housed on a multi-region cloud, using elastic scaling to handle; the peaks and troughs in usage.
• Outage reporting: We run a multi channel approach to maximise the opportunity of; users to review and understand any communication shared on; outages. This includes: - Emails to affected users. - A "status; page" on our corporate website - Use of Social media (Facebook; and Twitter) - Messaging shared within our WhatsApp user; group - Patient messaging via our patients facing, cloud based; interface - If appropriate, phone calls to users (dependant upon; scale) In addition, we undertake full business investigation of; any outages to fully understand what occurred and what; learnings we can take from it. An abstract of this review and any; changes being undertaken are shared with users within our; monthly newsletters.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password
• Access restrictions in management interfaces and support channels: Email address and password, including 2 factor authentication.; Data is only accessible over HSCN network.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: Between 1 month and 6 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: We have a broad range of policies to support our ISO27001; certification. We use a Jira add in to ensure that all polices are; read and confirmed by staff. Monthly internal audits are; performed to validate clauses of the standard. The Information; Security and Risk manager reports to the Chief operating; Officer, who sits on the Exec board. As a continous; improvement environment, we have a CAPA (Corrective; Actions/Preventative Actions) process in place, which we; record non-conformace and general security improvements.; Security incidents are reported via Jira Service Desk on a; dedicated request offering.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: We have formal change management processes in place with; AWS, recording all changes to production as part of our; ISO27001 ISMS.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: People Ensuring staff receive training on cyber security and; risks. We pay attention to: Social Engineering/Phishing, Secure; Passwords, Safe internet usage and removable media.; Testing/Monitoring Carry out annual Penetration testing of the; IT Infrastructure, Software applications and mobiles apps.; Implement monitoring solution to alert for unusual applications,; and attempted access activity along with log monitoring.; Reduce attach surface Remove all unnecessary services and; applications from the environment, removing potential risks; related to unneeded applications. Multi layers approach; Implement Perimeter Firewall, IDS and DLP protection along; with additional Firewall and IPS at internal points in the; infrastructure and application layer.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: Ensuring a central Log aggregation solution is in place, acting as; a repository for all Infrastructure and Application logging data.; Setting up Active Monitoring Listeners, allowing active; monitoring within the applications to alert to activity outside of; predefined norms. Implementing Passive monitoring of Critical; points in the application, infrastructure and security services; within organisation. Establishing robust alerting and escalation; mechanism to ensure that activity outside of predefined; thresholds is flagged to responsible managers, Dashboards also; provide visibility of systems. Establishing external monitoring; solution to monitor the internal monitoring solution, enabling; early warning of issues that will prevent adequate internal; monitoring.
• Incident management type: Supplier-defined controls
• Incident management approach: Each incident/prospective incident is logged with our helpdesk,; assigned a Ticket number and a support specialist. Our; specialist is responsible for gathering the scope of the incident; in terms of scale (affecting a single or multiple users).; Communicate to customers/internal stake holders that an; incident has occurred, and if possible, provide workarounds.; Gather relevant people to resolve incident, collaborate on best; course of action to resolve issue. Look at the root cause of the; incident, identify how to prevent the incident from occurring,; capture actions and assign responsibility for measures to; mitigate the risk of a similar incident occurring again.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: Yes
• Connected networks: Health and Social Care Network (HSCN)

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 22%
• Between £500,001 and £1,000,000: 30%
• Between £1,000,001 and £2,500,000: 35%
• Between £2,500,001 and £5,000,000: 40%
• Over £5,000,001: 50%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: BSI
• ISO/IEC 27001 accreditation date: Tuesday 25 November 2025
• What the ISO/IEC 27001 doesn’t cover: There are no exclusions in the scope of our ISMS
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 99274e12-505d-422b-9043-09921342cbca
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: 0c1628b4-f1d7-4b50-a6fb-c9fdc250945b
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
    • Understanding barriers to access to health and social care services or employment opportunities e.g. digital inclusion

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at sales@iplato.com. Tell them what format you need. It will help if you say what assistive technology you use.