Skip to main content

Help us improve the Digital Marketplace - send your feedback

Infonetica Ltd

Research Ethics Compliance Management Software

"EthicsRM" is a cloud-based Research Ethics Compliance Review Management system helping researchers collaborate on, submit, track and manage ethics applications, ethics reviews and ethics approvals. Users include Research Administrators, Ethics Administrators, Research Office at research universities, hospitals, Institutional Review Boards and government bodies to manage workflows for Ethics Committees.

Features

  • Create and configure interactive forms and workflows
  • Applicants can collaborate with researchers and supervisors to develop applications
  • Facilitate ethics committee reviewers to collaborate on submitted application reviews
  • Automated application classification, routing and assignment
  • Automated alerts for deadlines and milestones
  • Standard communication templates
  • Documentation repository
  • Role based dashboards
  • Reporting on portfolio status and KPIs
  • Audit trail on all project, applicant and user activity

Benefits

  • Significant cost savings from improved efficiency and accuracy
  • Save time of Research Managers, Reviewers and Secretaries
  • Eliminate paper and email correspondence regarding Ethics Compliance
  • Reduced Ethics Review and Ethics Compliance process workflow complexities
  • Improved data accuracy by reducing manual data entry and duplication
  • Improved flow of information between key research stakeholders
  • Reduce missed deadlines
  • Have easy access to all documentation and updates
  • Easily generate reports and track performance
  • Update ethics management and review workflow and forms any time

Pricing

£25,000 to £40,000 a licence a year

  • Education pricing available
  • Free trial available

Service documents

Request an accessible format
If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at Russell.Pridmore@infonetica.net. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 14

Service ID

1 1 2 0 4 1 0 3 5 7 3 7 2 7 9

Contact

Infonetica Ltd Russell Pridmore
Telephone: 0208 334 6900
Email: Russell.Pridmore@infonetica.net

Service scope

Software add-on or extension
Yes, but can also be used as a standalone service
What software services is the service an extension to
Research Management Platform ("Research Flow")
Cloud deployment model
Private cloud
Service constraints
No
System requirements
  • Internet
  • Web browser

User support

Email or online ticketing support
Email or online ticketing
Support response times
Tickets are classified into 4 groups depending on the nature of a ticket and the severity of the incident. The response rate is dependent on the severity. A table detailing response rates and escalation routes is included in the contract.
User can manage status and priority of support tickets
No
Phone support
Yes
Phone support availability
9 to 5 (UK time), Monday to Friday
Web chat support
No
Onsite support
Yes, at extra cost
Support levels
We provide training to system administrators to build forms and workflows as well as to manage and use the system. These training sessions are provided at the start of the service and subsequently additional days are available on a needs basis at a cost of £1,100 per day. The system is very intuitive such that historically users have not needed any training to use the system. In addition, we offer telephone, email and support via an Online Jira platform for any system related queries or issues. Clients would also have a single point of technical contact as further support.
Support available to third parties
Yes

Onboarding and offboarding

Getting started
We provide training to system administrators to build forms and workflows as well as to manage and use the system. These training sessions are provided at the start of the service and subsequently additional days are available on a needs basis. The system is very intuitive such that historically users have not needed any training to use the system. In addition, we offer telephone, email and support via an Online Jira platform for any system related queries or issues. Clients would also have a single point of technical contact as further support.
Service documentation
Yes
Documentation formats
PDF
End-of-contract data extraction
On termination or expiry of the Contract, or any Service being provided to the Customer under the Contract,
the Customer may request a release of the Customer Data in Native Format as stored within the Software, within 30 days of termination, using the Data Release Request form which will be supplied by Infonetica at the end of the contract.
End-of-contract process
Upon contract termination, Infonetica will collaborate closely with the University to ensure a smooth exit. Should the customer submit a Data Release Form (which will be provided by Infonetica at the end of the contract term), we will providing a copy of the system data in SQL.Bak format

Within 28 days of receipt of the Data Request Form, Infonetica can return to the customer all confidential Information of the customer. Customer data from the service will be provided in the native Format.

Once the University acknowledges the receipt of the returned data, Infonetica will expeditiously delete the system data from the live site. The data will be unrecoverable.

No additional charges are applied to the University unless there are additional requests.

Using the service

Web browser interface
Yes
Supported browsers
  • Microsoft Edge
  • Firefox
  • Chrome
Application to install
No
Designed for use on mobile devices
Yes
Differences between the mobile and desktop service
None
Service interface
No
User support accessibility
WCAG 2.1 AA or EN 301 549
API
Yes
What users can and can't do using the API
Using the API, users can export data to and import data from other systems. The API can consume as well as output in XML or JSON data.
API documentation
Yes
API documentation formats
  • PDF
  • Other
API sandbox or test environment
Yes
Customisation available
Yes
Description of customisation
System administrators can customise forms, workflows and branding. They can also customise screens and dashboards for various user types. Admnistrators and reviewers can customise their personal work area.

Scaling

Independence of resources
All customers run in their own resource pool. While the system is capable of utilising excess resources if required, we can also clamp the resources to ensure a single customer does not impact other users.

Analytics

Service usage metrics
Yes
Metrics types
Applications, users, reviewers and storage.
Reporting types
Reports on request

Resellers

Supplier type
Not a reseller

Staff security

Staff security clearance
Other security clearance
Government security clearance
Up to Baseline Personnel Security Standard (BPSS)

Asset protection

Knowledge of data storage and processing locations
Yes
Data storage and processing locations
United Kingdom
User control over data storage and processing locations
No
Datacentre security standards
Managed by a third party
Penetration testing frequency
At least once a year
Penetration testing approach
‘IT Health Check’ performed by a Tigerscheme qualified provider or a CREST-approved service provider
Protecting data at rest
  • Physical access control, complying with another standard
  • Encryption of all physical media
  • Scale, obfuscating techniques, or data storage sharding
Data sanitisation process
Yes
Data sanitisation type
Explicit overwriting of storage before reallocation
Equipment disposal approach
A third-party destruction service

Data importing and exporting

Data export approach
Users are be able to download their applications which include data they submit. At the end of the contract, clients would receive an extract of their data in the native format.
Data export formats
  • CSV
  • Other
Other data export formats
  • DOC
  • PDF
  • JSON
  • XML
  • HTML
Data import formats
  • CSV
  • Other
Other data import formats
  • XML
  • JSON

Data-in-transit protection

Data protection between buyer and supplier networks
TLS (version 1.2 or above)
Data protection within supplier network
TLS (version 1.2 or above)

Availability and resilience

Guaranteed availability
Service Availability during standard working hours = 99.9%

Service credits can be claimed during the month after a month where availability falls within the following bands:
Availability during a given month: 99.8-98.1% = 0% service credit
Availability during a given month: 98.00% = 3% service credit
Availability during a given month: 97.00% = 5% service credit
Availability during a given month: 96.00% or less = 8% service credit
Approach to resilience
All servers are virtualised and clustered. It is designed to be self healing so a working server will always take over from a failed server. We maintain a second facility that keeps a realtime copy of the Data and ensures the whole service is resilient from any hardware failure right through to entire data centre failure. Hourly backups with 90 day retention ensure partial data can be restored from a partial corruption or error.
Outage reporting
A customer dashboard displays overall SLA levels for the past 12 months.

Identity and authentication

User authentication needed
Yes
User authentication
  • Username or password
  • Other
Other user authentication
Ethics RM supports standard forms authentication out-of-the-box.It also supports various forms of Single Sign-on including ADFS, Azure and Shibboleth. Ethics RM also supports authentication directly through LDAP. We also offer dual authentication for institutions who have chosen a single sign-on system. This will allow both internal and external reviewers to access the system.
Access restrictions in management interfaces and support channels
We have tightly controlled privileged account access. Support require permission from clients to access their account through the management interface of the site.

Support have no direct access to backend systems and data. Direct management of internal systems controlling the data is tightly controlled by 2 senior employees.
Access restriction testing frequency
At least every 6 months
Management access authentication
  • Identity federation with existing provider (for example Google Apps)
  • Dedicated link (for example VPN)
  • Username or password

Audit information for users

Access to user activity audit information
Users have access to real-time audit information
How long user audit data is stored for
At least 12 months
Access to supplier activity audit information
Users contact the support team to get audit information
How long supplier audit data is stored for
At least 12 months
How long system logs are stored for
Between 6 months and 12 months

Standards and certifications

ISO/IEC 27001 certification
No
ISO 28000:2007 certification
No
CSA STAR certification
No
PCI certification
No
Cyber essentials
Yes
Cyber essentials plus
Yes
Other security certifications
No

Security governance

Named board-level person responsible for service security
Yes
Security governance certified
Yes
Security governance standards
  • ISO/IEC 27001
  • Other
Other security governance standards
CyberEssentials Plus accreditation.
Information security policies and processes
We have a full ISMS set of policies and processes covering all aspects of our Security and operations. This can be provided on request.

Operational security

Configuration and change management standard
Supplier-defined controls
Configuration and change management approach
We maintain a fully secured source control and change management system. All changes are peer reviewed before committing. Deployment of change is only possible from a committed change. We work on lots of small changes rather than significant bulk updates. If we make a substantial change to the solution security, this would trigger a fresh penetration test.
Vulnerability management type
Supplier-defined controls
Vulnerability management approach
Aside from regular penetration testing, we operate enterprise grade Malware and intrusion detection. This analyses our logs and services looking for vulnerabilities that match criteria supplied from common threat notification services. These services include IBM, Cylance & Alienvault OTX reports.

Patch management systems are in place to ensure critical updates are immediately deployed with Bi-Weekly patch reviews of non critical updates.
Protective monitoring type
Supplier-defined controls
Protective monitoring approach
Both our Malware detection and Security Management systems detect threat activities from application behaviour or logged events. If a potential compromise is detected, both are capable of tracing back the source of the compromise which helps identify what that compromise had access up to it's prevention or termination.

Potential compromises are investigated as a top priority and we have a full Incident response process to ensure we respond internally and notify users of any breach within the the ICO guidelines.
Incident management type
Supplier-defined controls
Incident management approach
We have a full incident management process detailing incident grading and response times. This can be provided on request.

Secure development

Approach to secure software development best practice
Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v3.0)

Public sector networks

Connection to public sector networks
No

Social Value

Social Value

Social Value

  • Fighting climate change
  • Equal opportunity

Fighting climate change

As a cloud-based service, our Research Ethics Compliance Management system offers reduced electricity consumption, higher utilisation rates across the cloud infrastructure and reduced reliance on infrastructure than any on-premise application

Equal opportunity

We are an equal opportunities employer with a diverse team. We have active equal opportunities policies for topics such as anti-discrimination, our equitable recruitment and selection process, and flexible working. One of our Core Values, which we use as a selection criteria for recruit, assess performance against, and demonstrate consistently, is 'Respect' which we define as including 'treating others as equals'.

Pricing

Price
£25,000 to £40,000 a licence a year
Discount for educational organisations
Yes
Free trial available
Yes
Description of free trial
A free instance of the service with limited users and user roles for a period of 6 months. Set-up support and customisation may be charged depending on complexity.

Service documents

Request an accessible format
If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at Russell.Pridmore@infonetica.net. Tell them what format you need. It will help if you say what assistive technology you use.