INTELLIGENT LILLI LIMITED

Lilli

Lilli platform uses data from discreet sensors placed in a home to provide evidence in line with the Care Act

Lilli enables providers of care to implement

Home first and D2A
Front door services
Reablement
Virtual wards
Outcomes
Waitlist management
Improved assessment
Right sizing Care packages
Cost savings and avoidance

Features

• Real Time reporting
• proactive remote monitoring and assessment service
• Non-Intrusive monitoring of venerable people in home setting
• Real time web based portal with customisable alerts & notifications
• Integration with services used by health & Social care
• Automated individual user reporting
• Management information packs and evidence of outcomes
• Open API for integration to other services
• Roaming SIM based connectivity included as part of licence
• Mobile app for carers and friends & family with notifications

Benefits

• Assists commissioners to create system capacity efficiency and savings
• Supports pathways inc D2A, Front Door, review and Reablement
• Supports vulnerable people to live independently
• Delivers measurable cost savings and cost avoidance
• Can be deployed by existing resources and front line teams
• Delivers service transformation through outcomes
• Aligned with Care act Domains supporting a strengths based approach
• Customer success team delivering wrap around implementation and contract support
• Implementation and onboarding models designed to meet outcomes at scale

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at tenders@intelligentlilli.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

557831530716651

Contact

Kelly Hudson
+44 7456 447118
tenders@intelligentlilli.com

About the service

• Service categories:
  • Application Development and Deployment
    • Application platforms
      • Model driven application platforms
        • Model driven application platforms
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model: Private cloud
• Service constraints: "Hardware is supplied by Lilli and pre configured as plug and play ; Purchaser cannot use their own hardware with the service; Solution includes SIM based connectivity as part of the licence cost, this cannot be removed ; Maintenance delivered overnight with Cache and back up in place to mitigate any data loss "
• System requirements:
  • Authenticated Lilli account
  • Access to the internet
  • Email account
  • A modern web browser Windows, Mac or Chrome os Power
  • Android or iPhone device to access platform remotely
  • Whitelisting of lilli domains https://app.intelligentlilli.com
  • Access to relevant app stores for mobile app preferable
  • Video conferencing access for training
  • 2FA available should buyer require it

User support

• Email or online ticketing support: Yes
• Support response times: Usually within 4 hrs.
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: Yes
• Web chat support availability: 24 hours, 7 days a week
• AI chatbot: No
• Web chat support accessibility standard: None or don’t know
• How the web chat support is accessible: "* The Web chat follows the Design language of Lilli apps, hence inherits the accessibility capabilities.; * As the Web Chat system adheres to HTML standards, Following accessibility features of Android/iPhone, Linux, Windows and macOS are available...; 1. Voiceover for screen reading and controlling app with voice; 2. Display settings such as invert colours, text size, contrasts and zoom; 3. Accessibility controls over Input system i.e. Mouse pointer and Keyboard"
• Web chat accessibility testing: The Web Chat was released in the past 3 weeks, we are yet to conduct formal testing with Assistive Technology users. This will be done as part of our scheduled Accessibility review.
• Onsite support: Yes
• Support levels: "We provide Onsite and On line technical support where required is included between 08:00; to 18:00 Monday to Friday. ; • Service critical queries which will be responded to within 2 hours, 24 hours a; day; • Non-service critical queries will be responded to between the hours of 8am; and 6pm within 2 hours"
• Support available to third parties: No

Onboarding and offboarding

• Getting started: We provide on site and online training for staff as per their preference. This includes extensive training on what the product is, how to use the platform, how to install and troubleshoot. We provide the clients with all necessary collateral, information, how to use guides, troubleshooting documentation and anything around who is best use the product in their role.
• Service documentation: Yes
• Documentation formats: PDF
• Documentation accessibility standard: EN 301 549
• End-of-contract data extraction: Data requests from users are handled by the data controller, and as data processor Lilli will then action these requests.
• End-of-contract process: "Data is kept as per our RoPA for 7 years then expunged from our databases. Subject Access Requests (SARs) requesting data deletion will be executed at; the direction of the data controller. We can produce a CSV file for free. Any; other form of data extraction depending on the requirements may come at an; extra cost. This would be determined on review and form part of a mutually; agreed extraction plan."

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
• Application to install: Yes
• Compatible operating systems:
  • Android
  • IOS
  • Linux or Unix
  • Windows
  • ChromeOS
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: None to date. All features on the mobile web app are available on the desktop.
• Service interface: Yes
• Description of service interface: "There are mobile and web versions of the interface.; ; The web and mobile app serves the monitoring of service insights about Lilli service users.; ; The web app also:; - allows staff users to manage the hardware installation and upkeep; - allows managers to admistrate staff users on Lilli, and also the Lilli service user profiles; - allows users to manage their notifications settings.; ; The mobile app also: ; - allows friends and family to monitor the Lilli service user insights for their loved one, the data is partitioned to support reassurance primarily."
• Accessibility standards: EN 301 549
• Accessibility testing: None
• User support accessibility: EN 301 549
• API: Yes
• What users can and can't do using the API: Lilli public API is primary interface to our service. This is currently used by all Lilli apps including Android/iPhone and Web to allow users to consume information from service and making any changes to Users, service configuration and any other options. Abilities are granted by user role and are based on the principle of least privilege. Depending on the role, users can view their organisation data, their own data, produce reports, install hardware, manage other users within their organisation.
• API documentation: Yes
• API documentation formats: Open API (also known as Swagger)
• API sandbox or test environment: No
• Customisation available: Yes
• Description of customisation: "What can be customised:; Alerting Preferences: Users can customise the types of alerts they receive. This includes specifying the conditions that trigger alerts; ; Integration Options: Customers can customise how alerts are integrated into their existing systems. This might involve integrating with third-party triage centers or incident management platforms, allowing for streamlined workflows and automated responses to alerts.; ; Sensors: Customers can customise the placement and configuration of the hardware to best montior a person's care needs. Additionally, we can do bespoke configurations to monitor e.g. medication adherence or falls detection.; ; How users can customise:; The above can be directly on the app. Or for besoke changes through customer success or through sales channels for new customers.; ; Who can customise:; Application users can adjust all the above settings that are applicable to users e.g. notications setttings and sensor placement.; Integrations will be handled on a case by case between Lilli and the customer."

Scaling

• Independence of resources: "All services run behind load-balancers to ensure no one service instance is overloaded by requests. Processes are continually monitored to detect spikes in usage. In the event of increase in demand, additional service instances are spun up to cater for it, response time is less than 10 minutes from spike to additionally provisioned servers.; ; Public-facing services (public APIs for apps) are deployed on Edge Servers (to the closest location to customers). These are deployed and scaled independently of other users, to ensure dedicated capacity.

Analytics

• Service usage metrics: Yes
• Metrics types: We provide a monthly program dashboard pack detailing statistics on ; Platform users ; Licence usage ; Service user status ; Friends and family usage; Training ; Tickets
• Reporting types: Real-time dashboards
• Resource tagging: No
• FOCUS resource tagging: No

Supplier type

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Staff screening not performed
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
• User control over data storage and processing locations: No
• Datacentre security standards: Supplier-defined controls
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest:
  • Physical access control, complying with another standard
  • Encryption of all physical media
• Data sanitisation process: Yes
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Data Erasure
  • Explicit overwriting of storage before reallocation / Secure Erase
• Equipment disposal approach: A third-party destruction service

Data importing and exporting

• Data export approach: "Users perform HTTPS API requests to API endpoints safeguarded by authorisation checks on their identity, organisation and roles. This allows them download data related to their user. ; "
• Data export formats:
  • CSV
  • Other
• Other data export formats: JSON
• Data import formats: Other
• Other data import formats: JSON

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: "Service uptime can be seen at http://status.intelligentlilli.com/; ; We do not provide an SLA for the service "
• Approach to resilience: A Multi-layered approach for robustness.; ; 1. Geographic Redundancy and Availability Zones:; Our infrastructure is deployed on Amazon Web Services (AWS), leveraging its global footprint and utilising services such as S3, Caching, and Lambda, which benefit from AWS's inherent resilience. We strategically deploy resources across multiple Availability Zones, ensuring redundancy and fault tolerance, while serving from within geographic zones.; ; 2. Horizontal Scaling:; We utilise Elastic Beanstalk and Elastic Container Service (ECS) to enable horizontal scaling, dynamically responding to increased demand. Scaling can be automated or manually triggered, allowing us to adapt to fluctuations in workload seamlessly.; ; 3. Read-only Workloads and Database Backups:; To further enhance scalability, we implement read-only workloads utilising backup copies of our databases. This approach optimises resource utilisation and ensures continued service availability under heavy load conditions.; ; 4. CloudFlare Integration:; Our public-facing REST APIs are protected by CloudFlare, offering several key benefits:; - Scalable and low-latency DNS resolution.; - Edge caching optimises data delivery, reducing latency and offloading traffic from our backend infrastructure.; - Intelligent business logic execution at edge nodes enables efficient data serving without querying AWS, enhancing scalability and responsiveness.; ; 5. Client-side Caching:; Our Web, Android, and iPhone apps employ secure data caching mechanisms,
• Outage reporting: Public dashboard at status.intelligentlilli.com shows live status of the platform.

Identity and authentication

• User authentication needed: Yes
• User authentication: Multi-Factor Authentication (MFA)
• Access restrictions in management interfaces and support channels: Username and password (with strengh rules enforced and common passwords disallowed), with option to mandate multi-factor-authentication
• Access restriction testing frequency: At least once a year
• Management access authentication: Multi-Factor Authentication (MFA)

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Software Security Code of Practice: Yes
• Security governance certified: Yes
• Security governance standards: Other
• Other security governance standards: Cyber Essentials, NHS DSPT
• Information security policies and processes: "Our reporting structure around Information Security is as follows; ; + Board; * Senior Management team; + Risk Control; * CTO; * CIO; * Engineering Teams; ; Frameworks; Lilli adheres to:; - Cyber Essentials: Controls against common cyber threats.; - Digital Technology Assessment Criteria (DTAC): Ensures safety and usability of digital health tools.; - Data Security and Protection Toolkit (DSPT).; ; Policies; Our key policies safeguard systems and customer information:; - InfoSec: Manages our Information Security Program.; - Access Control: Regulates access to data and systems.; - BYOD: Governs personal device use.; - Change Management: Controls system and process changes.; - Incident Management: Manages security incidents.; - Cryptography: Manages cryptographic keys and security.; - Logging & Monitoring: Manages telemetry for security incident diagnosis.; - Network Security: Secures networks to maintain integrity.; ; Risk Management; Lilli maintains a Risk Register and follows the **Lilli Information Risk Assessment & Treatment Methodology** for risk management.; ; Training and Awareness; Regular training and workshops update staff on security best practices.; ; Audit; Annual penetration testing checks system security.; ; Product Development; Guided by security policies, focusing on managing vulnerabilities.; ; Supplier Management; Rigorous evaluation of software suppliers based on security standards and data practices, including regular assessments."

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: "Tracking of Service Components Over Lifetime:; ; - Each component has a live Technical Design Document.; - Automated tests ensure ongoing service reliability.; - Source code and configurations are managed and versioned together.; - Runtime telemetry provides continuous performance insights.; - CPU, memory, and network usage are monitored to optimise performance.; - Automated testing continuously validates APIs and web applications.; ; Assessment of Changes for Potential Security Impact:; ; - Versioning, peer reviews of source code and Testing help identify security risks.; - Controlled environment testing detects performance discrepancies before deployment.; - Post-production analysis identifies and mitigates service vulnerabilities."
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: "At Lilli, the CIO and CTOr oversee Information Security and Vulnerability Management, supported by monthly-reviewed Risk Register. Internal telemetry monitors for unusual behaviours flagging potential risks. Our engineering teams prioritises continuous improvement, peer-reviews, versioned source-code and documentation alongside automated testing.; ; Regular audits, Cyber Essentials, DTAC, and DSPT standards, supplemented by annual independent assessments. We proactively manage vulnerabilities through:; ; - Regular updates on security threats.; - Deploying patches for OSs, and firmware, ensuring updates are tested and incrementally rolled out.; - Security awareness is bolstered by internal forums and continuous professional engagement, enhancing our development and security practices."
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: "Monitoring infrastructure:; ; - Data Collection: AWS Infrastructure, web traffic/threat metrics are captured in CloudWatch, Prometheus and CloudFlare.; - Data Visualisation: Dashboard show data-- errors, user interactions and uptime stats.; ; Intrusion Detection:; - Alerts on consumption patterns, network traffic, and unauthorised data access are captured via emails/slack.; - CloudFlare provides DDoS, bot protection and Web Application firewall.; ; Response:; - Structured response process involves assessment, communication and mitigation steps.; ; Incident Response SLA:; - SLAs are between 30 minutes to 48 hours, based on severity. We monitor the mean time to detect (MTTD) for quality improvement."
• Incident management type: Supplier-defined controls
• Post-quantum cryptography secure: No
• Incident management approach: Username and password (with strength rules enforced and common passwords disallowed), with option to mandate multi-factor-authentication

Secure development

• Approach to secure software development best practice: Supplier-defined process

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 1%
• Between £1,000,001 and £2,500,000: 2%
• Between £2,500,001 and £5,000,000: 2.5%
• Over £5,000,001: 3%

Standards and certifications

• ISO/IEC 27001 certification: No
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber Essentials Certificate Number: 647003f4-13d0-4ca0-b871-bf0342724247
• Cyber essentials plus: No
• Cyber Essentials Alternative: None of the criteria
• Other security certifications: No

Social value

• Mission: Kick start economic growth:

  To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

  Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

  • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
  • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
  • Ensuring new workers are informed of their right to join a trade union
  • Monitoring of employee engagement rates (by protected characteristic) and, where necessary, the development of actions to ensure all voices are heard across the diversity of the workforce
  • Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
  • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
  • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
  • Offer a pay and leave entitlement to all eligible staff who become kinship carers, ideally equivalent to statutory adoption pay and leave
  • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
  • Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible
  • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
  • Volunteering opportunities for staff
  • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors
  • Outline policies and practices to be applied to or put in place for the contract to mitigate and manage modern slavery risks, including: Pre-employment checks, recruitment practices. Workplace conditions, safeguarding plans and processes in place and regular monitoring with relevant groups considered, which may include sampling

  Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

  • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
• Mission: Make Britain a clean energy superpower:

  To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

  Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

  • Activities to reconnect people with the environment and increase awareness of ways to protect and enhance it
• Mission: Break down barriers to opportunity:

  By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

  Policy Outcome 6: Employment and training: For those who face barriers to employment

  • Understanding of the issues affecting inequality in employment, skills and pay in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors. Measures to tackle inequality in employment, skills and pay in the contract workforce
• Mission: Build an NHS fit for the future:

  That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

  Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

  • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
  • Understanding barriers to access to health and social care services or employment opportunities e.g. digital inclusion

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at tenders@intelligentlilli.com. Tell them what format you need. It will help if you say what assistive technology you use.