Hurdle

Hurdle - Diagnostics-as-a-Service

A secure, cloud-based digital diagnostics and health data platform enabling public sector organisations to deliver end-to-end remote testing services. The service supports kit fulfilment, laboratory processing, results management, patient engagement and reporting, integrating with clinical workflows to improve access, efficiency and population health outcomes.

Features

• Cloud-based end-to-end digital diagnostics management platform
• Secure patient registration and identity verification workflows
• Remote sample collection kit fulfilment and logistics integration
• Laboratory information management system integration and automation
• Real-time results processing and clinical rule engine
• Patient-facing digital portal and communications engine
• Clinician and commissioner dashboards with role-based access
• API integrations with NHS systems and partner platforms
• Configurable pathways for testing, treatment and follow-up
• UK-hosted infrastructure with NHS-aligned security controls

Benefits

• Expand access to testing without increasing clinical estate
• Reduce operational burden through automated workflows
• Improve turnaround times for results and interventions
• Increase patient engagement and completion rates remotely
• Enable scalable delivery across populations and geographies
• Support data-driven commissioning and service optimisation
• Maintain clinical safety through governed digital pathways
• Integrate seamlessly with existing NHS and local systems
• Strengthen information governance and data security compliance
• Deliver cost-efficient services with predictable outcomes

• Education pricing available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at markclune@gmail.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

558268993193876

Contact

Mark Clune
07812731315
markclune@gmail.com

About your service

• Service categories:

  Application Development and Deployment

  Application development

  • Software construction components
• Multi cloud support: Yes

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: N/a
• System requirements: None

User support

• Email or online ticketing support: Yes
• Support response times: Within 1 working day.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: None or don’t know
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes
• Support levels: We provide tiered support aligned to service criticality and customer needs.; ; Standard support (included); Business hours support (Monday–Friday, 09:00–17:00 UK) via email and service desk. Covers incident management, user queries, configuration support and routine service requests. Target response times are defined by severity and agreed service levels. No additional cost beyond the service fee.; ; Enhanced support (optional); Extended hours support (up to 08:00–20:00, seven days) with faster response times for high-priority incidents and operational issues. Includes proactive monitoring, service health checks and prioritised escalation. Charged as an additional monthly fee, agreed at call-off.; ; Managed service support (optional); Named Technical Account Manager providing service oversight, performance reviews, change coordination and escalation management. Includes access to specialist cloud and integration engineers as required. Charged as a fixed monthly or day-rate service, depending on scope.; ; Out-of-hours and incident support (optional); 24/7 critical incident support for essential services, including clinical or population-scale programmes. Charged on a retainer or per-incident basis.; ; Support models, response times and costs are agreed per call-off to ensure proportional, value-for-money delivery.
• Support available to third parties: No

Onboarding and offboarding

• Getting started: You will be assigned an account manage to ensure smooth onboarding onto the system.; Online documentation and access to a sandbox environment is provided.
• Service documentation: Yes
• Documentation formats: HTML
• End-of-contract data extraction: Export via the portal, or pull all data from the API.
• End-of-contract process: Depending on requirements all data can be exported and deleted.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
  • Other
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: None
• Service interface: Yes
• User support accessibility: WCAG 2.2 AAA
• Description of service interface: Online portal to manage the service.
• Accessibility standards: None or don’t know
• Description of accessibility: N/a
• Accessibility testing: N/a
• API: Yes
• What users can and can't do using the API: All functionality to manage and operate the service is available through the API. Full documentation is available at https://docs.hurdle.bio/
• API documentation: Yes
• API documentation formats:
  • Open API (also known as Swagger)
  • HTML
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: White label user interfaces and notifications into your brand (this can be managed via your portal).; Create custom pathways base on your business procedures.

Scaling

• Independence of resources: We prevent one user’s demand from impacting others by enforcing resource isolation and fair-use controls within the shared service. The service is continuously monitored against performance thresholds, with automatic scaling and capacity management to maintain agreed service levels during peak demand.

Analytics

• Service usage metrics: Yes
• Metrics types: Dependant on the service used, example metrics:; ; Sample Quality & Processing: % of samples recollected, % of samples failing QC, Avg time from recollection trigger to new sample received, % of incomplete panels flagged pre-release; ; Logistics & Timeliness: Avg TAT, % of kits delayed in outbound delivery, % of kits delayed in return to lab delivery, % of kits delayed in return to lab delivery; ; Status Communication: % of events successfully pushed; ; Operational & Clinical Exceptions: # of partner-facing queries logged, # of flagged clinical escalations and time to act
• Reporting types:
  • Regular reports
  • Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: None

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
  • Other locations
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Physical access control, complying with SSAE-18 / ISAE 3402
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Data Erasure
  • Physical Destruction / Hardware containing data is completely destroyed

Data importing and exporting

• Data export approach: Data exports can be performed via the portal.; Alternatively, you can use the API to pull data as required.
• Data export formats: CSV
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: Contract dependant.
• Approach to resilience: Available on request.
• Outage reporting: Public dashboard https://hurdlebio.statuspage.io/ and email alerts.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password
  • Other
• Other user authentication: API Key
• Access restrictions in management interfaces and support channels: Access to management portal is restricted using role-based access control and the principle of least privilege. All access is logged and monitored.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: User-defined

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: We maintain a formal information security management framework aligned with recognised standards, including ISO/IEC 27001 principles and Cyber Essentials Plus.; ; Our information security policies cover data protection, access control, incident management, supplier security, risk management, and business continuity. Policies are reviewed regularly and approved by senior management.; ; All staff receive security awareness training appropriate to their role, and adherence to policies is reviewed through periodic internal checks and management review. Where issues are identified, corrective actions are tracked to completion to ensure continuous improvement.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: We operate a formal configuration and change management process aligned to ISO 27001 principles. Service components (infrastructure, applications, configurations) are tracked through their full lifecycle using version-controlled repositories and asset inventories, from design and deployment through change, retirement, and decommissioning. All changes follow a documented change workflow with peer review and approval. Security impact is assessed as part of change evaluation, including risk analysis, dependency review, and testing. High-risk changes require explicit security sign-off before implementation, with full audit trails maintained.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: We operate a vulnerability management process aligned to ISO 27001 and Cyber Essentials Plus requirements. Potential threats are identified through continuous monitoring, automated vulnerability scanning, dependency and configuration reviews, and risk assessments considering impact and likelihood. Vulnerabilities are prioritised by severity and business risk. Critical vulnerabilities are remediated or mitigated within 14 days, with high and medium risks addressed through defined patching cycles. Threat intelligence is sourced from vendor security advisories, CVE/NVD feeds, cloud service provider alerts, and independent security research, supported by internal testing and monitoring.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: We operate protective monitoring aligned to ISO 27001 and Cyber Essentials Plus. Potential compromises are identified through centralised logging, continuous monitoring of systems and network activity, automated alerts, and periodic review of security events. Alerts are triaged based on severity and risk. When a potential compromise is identified, we follow a documented incident response process covering containment, investigation, remediation, and recovery. Security incidents are acknowledged promptly, with critical incidents investigated immediately and responded to within defined SLAs.
• Incident management type: Supplier-defined controls
• Incident management approach: We operate a formal incident management process aligned to ISO 27001. Pre-defined procedures exist for common security and operational incidents, including escalation, containment, investigation, and recovery. Users report incidents via designated support channels and monitored email, which are triaged and logged centrally. Incidents are managed according to severity with clear ownership and response targets. For security incidents, we provide timely incident reports to affected customers, including impact assessment, actions taken, and remediation measures, with post-incident reviews conducted to drive continuous improvement.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 0%
• Between £2,500,001 and £5,000,000: 0%
• Over £5,000,001: 0%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: BSI (British Standards Institution)
• ISO/IEC 27001 accreditation date: Tuesday 18 April 2023
• What the ISO/IEC 27001 doesn’t cover: The ISO/IEC 27001:2013 certification covers the Information Security Management System relating to protecting the confidentiality, integrity, and availability of sensitive health data for partners and end-users delivered via the Hurdle platform, in accordance with the defined Statement of Applicability.; ; The certification does not extend to systems, services, or infrastructure that are operated independently by third-party partners outside the defined scope of the certified Information Security Management System.; ; Where third-party services are used, information security risks are managed through contractual controls, supplier assurance processes, and verification of equivalent security standards, ensuring that overall service security is maintained in line with our governance framework.
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 95f997ee-2cde-4797-bf66-da5d0c96404b
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: 03f9bd4c-b4eb-4d55-ba6f-bb61453bf073
• Other security certifications: Yes
• Any other security certifications:
  • SOC 2 Type I
  • ICO Registration (UK GDPR)
  • DCB0129
  • DCB0160
  • ISO 13485:2016

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Collaborative ways of working with the supply chain to deliver additional environmental benefits in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Delivery of additional environmental benefits through the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Understanding of how to influence staff, suppliers, customers, communities and/or any other appropriate stakeholders through the delivery of the contract to support climate and nature protection and improvement
    • Activities to reconnect people with the environment and increase awareness of ways to protect and enhance it

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at markclune@gmail.com. Tell them what format you need. It will help if you say what assistive technology you use.