HealthOrbit AI

Smart AI Voice Assistant

HealthOrbit AI voice platform is designed for practices to deploy custom voice agents based on need to solve specific challenges like appointment management, pharmacy refills, clinical screenings like ADHD etc

Features

• Conversational AI used to manage specific challenges
• Multi language support
• Intelligent documentation at the end of the coversation
• Integration with NHS services and systems
• Ability to scale

Benefits

• Operational efficiency
• Serve large population than managing with humans
• Language agnostic
• Fully monitored at all time
• Real time call analytics

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at jobin.jose@healthorbit.ai. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

773348666483793

Contact

Jobin Jose
+44 7570 312208
jobin.jose@healthorbit.ai

About your service

• Service categories:

  Application Development and Deployment

  AI platforms

  AI software services

  • Conversational AI Software Services
• Multi cloud support: Yes

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: None
• System requirements: Clearly defined call workflows

User support

• Email or online ticketing support: Yes
• Support response times: Based on agreed SLAs
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AAA
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), 7 days a week
• Web chat support: Yes
• Web chat support availability: 24 hours, 7 days a week
• Web chat support accessibility standard: WCAG 2.2 AAA
• Web chat accessibility testing: Several of our customers already use our web chat for support
• Onsite support: No
• Support levels: HealthOrbit provides platinum, gold and silver support plans. Each customer will get a customer success manager and shared support engineering teams.
• Support available to third parties: Yes
• AI chatbot: Yes

Onboarding and offboarding

• Getting started: Self and guided onboarding. Additional training is provided as required
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: Defined as per the data retention agreement
• End-of-contract process: Data sharing at the end of the contract is included in the price of the contract
• Documentation accessibility standard: WCAG 2.2 AAA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: None
• Service interface: No
• User support accessibility: WCAG 2.2 AAA
• API: Yes
• What users can and can't do using the API: Users can exchange data between HealthOrbit and multiple systems
• API documentation: Yes
• API documentation formats:
  • HTML
  • PDF
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Authorized customer admins can create and deploy their own AI agents

Scaling

• Independence of resources: HealthOrbit AI is a horizontally and vertically scalable system designed to manage millions of concurent requests from multiple geographies

Analytics

• Service usage metrics: Yes
• Metrics types: Matrices will be defined along with the customer during implementation
• Reporting types:
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: Yes
• FOCUS resource tagging: Yes

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least every 6 months
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Encryption of all physical media
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Data Erasure
  • Explicit overwriting of storage before reallocation / Secure Erase
  • Degaussing

Data importing and exporting

• Data export approach: Designated customer admins can export the data from the system
• Data export formats: CSV
• Data import formats:
  • CSV
  • Other
• Other data import formats: PDF

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • Legacy SSL and TLS (under version 1.2)

Availability and resilience

• Guaranteed availability: HealthOrbit AI guarantees 99.9% uptime through the year.
• Approach to resilience: Our service is designed for resilience by assuming that failure is inevitable. We achieve this by deploying stateless applications across multiple availability zones to ensure no single point of failure (redundancy). We implement circuit breakers and bulkhead patterns to prevent cascading failures if a dependency goes down, ensuring graceful degradation of the user experience. Finally, we use auto-scaling to handle traffic spikes, and our team regularly runs chaos engineering drills to proactively test our recovery speed (Mean Time to Recovery) and ensure we are building for reliability from the code level up
• Outage reporting: Multiple channels like notifications, emails, alerts and dashboards

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password
• Access restrictions in management interfaces and support channels: MFA and strict password enforcement policies
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: User-defined

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards:
  • CSA CSM version 4.0
  • ISO/IEC 27001
• Information security policies and processes: HealthOrbit follows SOC Type 1 and SOC Type 2 policies. Our Chief security officer along with a team of security experts oversee the system security
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: Our approach to configuration and change management is built on an integrated framework designed to ensure system integrity while minimizing operational risk. We maintain a comprehensive Configuration Management Database (CMDB) that acts as our single source of truth, identifying every configuration item (CI) and its dependencies to provide full visibility into the system's baseline state. By automating deployment through version control and establishing verified rollback plans for every implementation, we guarantee that all changes are traceable, tested, and aligned with project objectives without disrupting business continuity
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: We follow a proactive, risk-based lifecycle centered on continuous discovery, prioritization, and remediation to ensure a hardened security posture. We utilize automated scanning tools to maintain a real-time inventory of assets and identify weaknesses, which are then analyzed using the Common Vulnerability Scoring System alongside business-context risk factors. High-priority threats are addressed through a formal remediation workflow, where patches are tested and deployed according to strict SLAs, while compensating controls are applied to mitigate risks that cannot be immediately patched. The cycle concludes with mandatory verification scanning and detailed reporting to ensure all vulnerabilities are successfully closed
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: Our protective monitoring process employs a 24/7 security operations center model that utilizes Security Information and Event Management tools, such as Microsoft Sentinel, to aggregate and correlate logs across our entire infrastructure. By applying advanced User and Entity Behavior Analytics (UEBA) and real-time threat intelligence feeds, we proactively identify anomalous patterns, unauthorized access attempts, and potential data exfiltration before they escalate into breaches. Every alerted event is triaged through a formal Incident Response Plan, ensuring that suspicious activities are met with immediate containment actions.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: We operate a tiered support model where incidents are logged via a central service desk, categorized by severity, and assigned to technical teams based on predefined Service Level Agreements (SLAs). For major incidents, we activate a Crisis Management Team to coordinate communication and technical recovery, ensuring a swift return to normal operations. Every closed incident concludes with a Post-Incident Review (PIR) to identify root causes and implement preventative measures, ensuring continuous improvement of our system resilience.
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Conforms to a recognised standard, but self-assessed

Public sector networks

• Connection to public sector networks: Yes
• Connected networks: Other
• Other public sector networks: NHS PDS

Pricing

• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: 14-day free trial. Includes full access to Smart AI Voice Assistant for one site, onboarding and standard support. Excludes custom integrations, bespoke workflows/configuration, additional implementation services, and long-term contract pricing. Trial is time-limited to 14 days and ends automatically unless extended by mutual agreement.

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 10%
• Between £250,000 and £500,000: 10%
• Between £500,001 and £1,000,000: 15%
• Between £1,000,001 and £2,500,000: 15%
• Between £2,500,001 and £5,000,000: 20%
• Over £5,000,001: 20%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: UAF
• ISO/IEC 27001 accreditation date: Friday 16 August 2024
• What the ISO/IEC 27001 doesn’t cover: Our ISO/IEC 27001:2022 certification covers the Information Security Management System (ISMS) for protection of information assets, secure development and maintenance of HealthOrbit products, management of electronic health records and clinical data security, and secure interoperability with other healthcare systems, as defined in the certificate scope/SoA. Any third-party services used outside this scope (for example customer-managed systems or external suppliers not under our ISMS control) are not covered.
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: Fd17025c-1be1-4c0d-8d2d-5406a985e145
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: Aea8c2da-c581-42e6-ad76-ce34a6f3ff7a
• Other security certifications: Yes
• Any other security certifications: ISO 27018

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
    • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

    • Measures to involve local stakeholders and/or users in design (e.g. in the design of services, systems, products or buildings)

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at jobin.jose@healthorbit.ai. Tell them what format you need. It will help if you say what assistive technology you use.