HUMA THERAPEUTICS LIMITED

Huma GP Websites

Huma websites are a highly configurable website offering for general practice that uses NHS maintaining to improve patient recognition and confidence.

Features

• Utilise NHS branding to improve patient confidence
• Mobile responsive layout
• Custom forms available
• Practice administration dashboard
• Configure to meet local SOPs
• Integrate procured digital services seamlessly
• Self-help, Pharmacy Support, Digital and Social prescribing

Benefits

• Improve digital engagement with patients
• Optimise use of your Online Consultation tools
• Customise for specific campaigns
• Relieve pressure on phone lines
• Collect and manage patient feedback

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at aman.kundraw@huma.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

468354262969399

Contact

Aman Kundraw
07943881778
aman.kundraw@huma.com

About the service

• Service categories:

  Applications

  Production and operations

  Service industry and public sector operations

  • Healthcare
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: None
• System requirements: Up to date web browser

User support

• Email or online ticketing support: Yes
• Support response times: Upport hours 08:00 – 18:00 Monday – Friday Response times; are determined by priority. In addition to email, we provide live; chat support via our website and telephone support. Priority 1:; Within 1 hour Priority 2: Within 2 hours Priority 3: Same
• User can manage status and priority of support tickets: No
• Phone support: No
• Web chat support: No
• Onsite support: No
• Support levels: Support hours 08:00 – 18:00 Monday – Friday. Response times; are determined by priority. In addition to email, we provide live; chat support via our website and telephone support. Priority 1:; Within 1 hour Priority 2: Within 2 hours Priority 3: Same day; Priority 4: Same day - acknowledgement and triaged.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: The platform is built on a self service model.; Support documentation and videos are provided to support practices in local configuration.
• Service documentation: Yes
• Documentation formats: HTML
• End-of-contract data extraction: All data is purged when the contract ends. Should the practice/user wish to retain any relevant data, requests can be made our support desk.
• End-of-contract process: Customer are required to provide a 90 day notice period. Upon; request, the agreement will not auto renew. Customer will; internally agree step down pathways and business continuity; approach. We will support this process for smooth transition.; We share best practice with users to support a smooth; transition/termination.
• Documentation accessibility standard: WCAG 2.2 A

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
  • Other
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: The platform is accessible via a web browser. The; web version is compatible with internet browsers that carry; 99% of all internet traffic (inc mobile browsers), and is written; as a responsive web platform to ensure optimum display across; screen sizes and devices/mobile.
• Service interface: No
• User support accessibility: WCAG 2.2 A
• API: No
• Customisation available: Yes
• Description of customisation: - Forms used; - Configuration of workflows and SOPs; - Custom wording and images

Scaling

• Independence of resources: All processing occurs on our multi-tier, AWS London; infrastructure, which is configured for elastic scaling in order to; handle peaks and troughs in usage

Analytics

• Service usage metrics: Yes
• Metrics types: - Website hits; - User time on site; - Services/options interacted
• Reporting types:
  • Regular reports
  • Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Supplier type

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Supplier-defined controls
• Penetration testing frequency: Less than once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Encryption of all physical media
  • Scale, obfuscating techniques, or data storage sharding
• Data sanitisation process: Yes
• Equipment disposal approach: In-house destruction process
• Data sanitisation type: Deleted data can’t be directly accessed / Cryptographic Erasure

Data importing and exporting

• Data export approach: Export request can be made to our first line support team.
• Data export formats: CSV
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • Private network or public sector network
  • TLS (version 1.2 or above)
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

• Guaranteed availability: Guaranteed availability of 99.9% - this excludes planned; downtime for regular product releases and spot fixes. This is; communicated to customers well in advance. All product; releases are undertaken at the quietest period of usage and; typically are completed as "blue/green" deployments (i.e. no; downtime). No refund or credit scheme is currently in place.
• Approach to resilience: Housed in UK-based, multi-region, Tier 3 Data Centres for high; availability and resilience. Our range of products are utilised by; more than 1500 unique organisations UK wide, and uptime has; been stable at 99.9% for last 24 months. Our products are; housed on a multi-region cloud, using elastic scaling to handle; the peaks and troughs in usage.
• Outage reporting: We run a multi channel approach to maximise the opportunity of; users to review and understand any communication shared on; outages. This includes: - Emails to affected users. - A "status; page" on our corporate website - Use of Social media (Facebook; and Twitter) - Messaging shared within our WhatsApp user; group - Patient messaging via our patients facing, cloud based; interface - If appropriate, phone calls to users (dependant upon; scale) In addition, we undertake full business investigation of; any outages to fully understand what occurred and what; learnings we can take from it. An abstract of this review and any; changes being undertaken are shared with users within our; monthly newsletters.

Identity and authentication

• User authentication needed: Yes
• User authentication: Username or password
• Access restrictions in management interfaces and support channels: All access is via a VPN, using MFA and SSH keys
• Access restriction testing frequency: Less than once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Username or password

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: Between 1 month and 6 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: We have a broad range of policies to support our ISO27001; certification. We use a Jira add in to ensure that all polices are; read and confirmed by staff. Monthly internal audits are; performed to validate clauses of the standard. The Information; Security and Risk manager reports to the Global Director,; People & Compliance, Regulatory, who sits on the Exec board.; As a continous improvement environment, we have a CAPA; (Corrective Actions/Preventative Actions) process in place,; which we record non-conformace and general security; improvements. Security incidents are reported via Jira Service; Desk on a dedicated request offering.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: We have formal change management processes in place with; AWS, recording all changes to production as part of our; ISO27001 ISMS
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: We use Codacy and Snyk for code quality and library; vulnerabiities. We perform quarterly Vulnerability scans and; yearly Penetration testing (or on major release) We are signed; up to the NCSC Weekly Threat Report and also get threat; reports from NHS England and our security partner Critical risk; vulnerabilities – 2 Business days High risk vulnerabilities – 5; Business days Medium risk vulnerabilities – 15 Business days; Low risk vulnerabilities – 30 Business days
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: We use Datadog for all security alerting. Datadog monitors; events such as component issues, to service issues to security; issues, for example, a server fails to start as a component issue,; failure to connect to NHS Login service as a service issue and; excessive connection attempts by one address made in quick; succession. All of these alerts are available in the console and; via Google Chat alerts
• Incident management type: Supplier-defined controls
• Incident management approach: An Incident Management policy is in place. Incidents are; investigated and resolved. This could lead to a change request.; Service impacting issues are reported on our status page.; https://status.econsult.net Major incidents are reported to the; NHS England helpdesk and a full incident report is generated.; Clinical incidents are reported via the website and our Clinical; Governance team investigate each one thoroughly. Responding; back promptly and offering a full explanation of our findings at; the end of the investigation.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 15%
• Between £500,001 and £1,000,000: 20%
• Between £1,000,001 and £2,500,000: 25%
• Between £2,500,001 and £5,000,000: 30%
• Over £5,000,001: 30%

Standards and certifications

• ISO/IEC 27001 certification: Yes
• ISO/IEC 27001 accredited by: BSI
• ISO/IEC 27001 accreditation date: Tuesday 25 November 2025
• What the ISO/IEC 27001 doesn’t cover: There are no exclusions in the scope of our ISMS
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber Essentials Certificate Number: 675a6f9c-077b-430b-93e0-9ba0084dcaec
• Cyber essentials plus: Yes
• Cyber Essentials Plus Certificate Number: Ee13ea4d-c95d-4488-82ad-053361c91272
• Other security certifications: No

Social value

• Mission: Build an NHS fit for the future:

  That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

  Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

  • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
  • Understanding barriers to access to health and social care services or employment opportunities e.g. digital inclusion

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at aman.kundraw@huma.com. Tell them what format you need. It will help if you say what assistive technology you use.