HealthOrbit AI

Clinical Correspondence Management

This is a specialised digital platform designed to centralize, digitize, and automate the handling of patient-related communications, such as lab reports, referral letters, discharge summaries etc. By leveraging OCR capabilities HealthOrbit generates critical information from the documents for doctors and clincians

Features

• Extracting critical data from clinical documents using OCR
• Clinical document management
• Data exchange between systems using integration

Benefits

• OCR capabilities enables pulling critical information from clinical documentation
• Seamless integration between systems

• Education pricing available
• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at jobin.jose@healthorbit.ai. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

899794023313438

Contact

Jobin Jose
+44 7570 312208
jobin.jose@healthorbit.ai

About your service

• Service categories:

  Application Development and Deployment

  AI platforms

  AI life cycle

  • AI Build Software

  AI software services

  • Document AI Software Services
• Multi cloud support: Yes

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: None
• System requirements: Browser with internet connectivity

User support

• Email or online ticketing support: Yes
• Support response times: Based on SLA
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AAA
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), 7 days a week
• Web chat support: Yes
• Web chat support availability: 24 hours, 7 days a week
• Web chat support accessibility standard: WCAG 2.2 AAA
• Web chat accessibility testing: Several of our customers use our web chat tools for support
• Onsite support: Yes
• Support levels: HealthOrbit offers Platinum, gold and silver support plans. Customer success manager and support engineers are allocated to all customers
• Support available to third parties: Yes
• AI chatbot: Yes

Onboarding and offboarding

• Getting started: Self onboarding using guided help and videos. Online training will be provided as needed
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: HealthOrbit signs a data extraction agreement during the contract phase with the customer. Data will be extracted and shared based on this agreement
• End-of-contract process: Data extraction
• Documentation accessibility standard: WCAG 2.2 AAA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
• Application to install: No
• Designed for use on mobile devices: No
• Service interface: Yes
• User support accessibility: WCAG 2.2 AAA
• Description of service interface: To exchange data between systems
• Accessibility standards: WCAG 2.2 AAA
• Accessibility testing: Integration testing has been done
• API: Yes
• What users can and can't do using the API: Exchange data between HealthOrbit and other systems
• API documentation: Yes
• API documentation formats:
  • HTML
  • PDF
• API sandbox or test environment: Yes
• Customisation available: No

Scaling

• Independence of resources: HealthOrbit is a vertically and horizontally scalable system designed to management high number of concurrent requests from users across geographies

Analytics

• Service usage metrics: Yes
• Metrics types: Healthorbit will work with the customer to define the matrices that are required
• Reporting types:
  • API access
  • Real-time dashboards
  • Regular reports
• Resource tagging: Yes
• FOCUS resource tagging: Yes

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least every 6 months
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Physical access control, complying with another standard
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Data Erasure
  • Explicit overwriting of storage before reallocation / Secure Erase

Data importing and exporting

• Data export approach: Designated customer admins will be able to export the data from the system from the UI
• Data export formats: CSV
• Data import formats:
  • CSV
  • Other
• Other data import formats: PDF

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • Legacy SSL and TLS (under version 1.2)

Availability and resilience

• Guaranteed availability: HealthOrbit commits to 99.9% uptime round the year
• Approach to resilience: We operate a tiered support model where incidents are logged via a central service desk, categorized by severity, and assigned to technical teams based on predefined Service Level Agreements (SLAs). For major incidents, we activate a Crisis Management Team to coordinate communication and technical recovery, ensuring a swift return to normal operations. Every closed incident concludes with a Post-Incident Review (PIR) to identify root causes and implement preventative measures, ensuring continuous improvement of our system resilience.
• Outage reporting: Notifications, Dashboards, email alerts etc

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password
• Access restrictions in management interfaces and support channels: MFA and strict password policies
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: User-defined

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards:
  • CSA CSM version 4.0
  • ISO/IEC 27001
• Information security policies and processes: HealthOrbit follows SOC Type 1 and SOC Type 2 policies. Our Chief security officer along with a team of security experts oversee the system security
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: Our approach to configuration and change management is built on an integrated framework designed to ensure system integrity while minimizing operational risk. We maintain a comprehensive Configuration Management Database (CMDB) that acts as our single source of truth, identifying every configuration item (CI) and its dependencies to provide full visibility into the system's baseline state. By automating deployment through version control and establishing verified rollback plans for every implementation, we guarantee that all changes are traceable, tested, and aligned with project objectives without disrupting business continuity
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: We follow a proactive, risk-based lifecycle centered on continuous discovery, prioritization, and remediation to ensure a hardened security posture. We utilize automated scanning tools to maintain a real-time inventory of assets and identify weaknesses, which are then analyzed using the Common Vulnerability Scoring System alongside business-context risk factors. High-priority threats are addressed through a formal remediation workflow, where patches are tested and deployed according to strict SLAs, while compensating controls are applied to mitigate risks that cannot be immediately patched. The cycle concludes with mandatory verification scanning and detailed reporting to ensure all vulnerabilities are successfully closed
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: Our protective monitoring process employs a 24/7 security operations center model that utilizes Security Information and Event Management tools, such as Microsoft Sentinel, to aggregate and correlate logs across our entire infrastructure. By applying advanced User and Entity Behavior Analytics (UEBA) and real-time threat intelligence feeds, we proactively identify anomalous patterns, unauthorized access attempts, and potential data exfiltration before they escalate into breaches. Every alerted event is triaged through a formal Incident Response Plan, ensuring that suspicious activities are met with immediate containment actions.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: We operate a tiered support model where incidents are logged via a central service desk, categorized by severity, and assigned to technical teams based on predefined Service Level Agreements (SLAs). For major incidents, we activate a Crisis Management Team to coordinate communication and technical recovery, ensuring a swift return to normal operations. Every closed incident concludes with a Post-Incident Review (PIR) to identify root causes and implement preventative measures, ensuring continuous improvement of our system resilience
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Conforms to a recognised standard, but self-assessed

Public sector networks

• Connection to public sector networks: Yes
• Connected networks: Other
• Other public sector networks: NHS PDS

Pricing

• Discount for educational organisations: Yes
• Free trial available: Yes
• Description of free trial: 14-day free trial. Includes full access to AI Clinical Workflow for one site, onboarding and standard support. Excludes custom integrations, bespoke configuration, data migration, additional implementation services, and long-term contract pricing. Trial is time-limited to 14 days and ends automatically unless extended by mutual agreement.

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 10%
• Between £250,000 and £500,000: 10%
• Between £500,001 and £1,000,000: 15%
• Between £1,000,001 and £2,500,000: 15%
• Between £2,500,001 and £5,000,000: 20%
• Over £5,000,001: 20%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: UAF
• ISO/IEC 27001 accreditation date: Friday 16 August 2024
• What the ISO/IEC 27001 doesn’t cover: Our ISO/IEC 27001:2022 certification covers the Information Security Management System (ISMS) for protection of information assets, secure development and maintenance of HealthOrbit products, management of electronic health records and clinical data security, and secure interoperability with other healthcare systems, as defined in the certificate scope/SoA. Any third-party services used outside this scope (for example customer-managed systems or external suppliers not under our ISMS control) are not covered.
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: Fd17025c-1be1-4c0d-8d2d-5406a985e145
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: Aea8c2da-c581-42e6-ad76-ce34a6f3ff7a
• Other security certifications: Yes
• Any other security certifications: ISO 27018

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
    • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

    • Measures to involve local stakeholders and/or users in design (e.g. in the design of services, systems, products or buildings)

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at jobin.jose@healthorbit.ai. Tell them what format you need. It will help if you say what assistive technology you use.