METADVICE LTD

Metadvice-AI

Metadvice is a cloud-based clinical decision support and population health analytics service for primary care. It analyses routinely collected health record data to support guideline-aligned management of cardiovascular, renal, and metabolic long-term conditions, helping clinicians identify unmet clinical need and optimise treatment while retaining full clinical responsibility.

Features

• Clinical decision support aligned to NICE guidelines using routine data
• Population health analytics across cardiovascular, renal, and metabolic conditions
• Risk stratification to identify patients with unmet clinical need
• Multimorbidity-aware treatment insights across interacting long-term conditions
• Real-time analysis of primary care electronic health record data
• EMIS and TPP SystmOne integration via approved NHS interfaces
• Clinician-facing application accessible within existing clinical workflows
• Explainable outputs supporting clinician interpretation and decision-making
• Secure cloud-based SaaS hosted on NHS-approved infrastructure
• Configurable analytics views for clinicians and population health teams

Benefits

• Supports consistent, guideline-aligned clinical decisions at the point of care
• Enables proactive population-level management of long-term conditions
• Helps teams focus effort on patients with greatest clinical need
• Simplifies decision-making for patients with multiple interacting conditions
• Reduces manual record review by analysing data automatically
• Avoids duplicate data entry through native GP system integration
• Fits seamlessly into existing clinical workflows with minimal disruption
• Improves clinician confidence through transparent, interpretable insights
• Reduces local IT burden with secure, centrally managed hosting
• Enables tailored views for different clinical and management roles

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at bhulme@metadvice.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

118353362314570

Contact

Ben Hulme
07711419714
bhulme@metadvice.com

About the service

• Service categories:
  • Application Development and Deployment
    • Analytics and business intelligence
      • Advanced and predictive analytics
        • Advanced and predictive analytics
• Multi cloud support: No

Service scope

• Software add-on or extension: Yes
• What software services is the service an extension to: Metadvice acts as extension to GP clinical systems (EMIS Web/TPPSystmOne), using approved NHS interfaces to analyse routinely collected record data and present decision support and population health analytics within existing workflows. Software development and platform engineering are provided by Metadvice SA, with Metadvice Ltd remaining the sole contracting entity.
• Cloud deployment model: Private cloud
• Service constraints: The service is delivered as a cloud-based SaaS and requires access to supported GP clinical systems, currently EMIS Web and TPP SystmOne. Use is limited to supported desktop browsers and configurations, as set out in the Service Definition. Planned maintenance is scheduled outside core working hours where possible and notified in advance. Support is provided during UK business hours. Service availability and performance depend on the quality, completeness, and timeliness of data from source systems and local information governance approvals.
• System requirements:
  • Supported desktop web browser (Chrome, Edge, Firefox, or Safari)
  • Access to EMIS Web or TPP SystmOne clinical system
  • Secure internet connection within NHS-approved network environment

User support

• Email or online ticketing support: Yes
• Support response times: Yes. Support is provided via email and an online ticketing system. Requests are automatically logged and acknowledged on receipt. During UK business hours (08:00–18:00, Monday to Friday), initial responses are typically provided within one business day. Issues are prioritised based on severity in line with the Service Definition and SLA. Outside business hours, requests may be logged but will be responded to on the next business day. Weekend and bank holiday support is not routinely provided unless otherwise agreed in the Order Form.
• User can manage status and priority of support tickets: No
• Phone support: No
• Web chat support: No
• Onsite support: No
• Support levels: Metadvice provides a single standard support level for all Buyers. Support is provided via email with an integrated ticketing system and is available during UK business hours (08:00–18:00, Monday to Friday). Requests are automatically logged and prioritised based on severity in line with the Service Definition and SLA.; ; Support is included within the service price. There are no additional support tiers or separate charges for support.; ; Support is delivered by Metadvice’s clinical and technical support team, who handle incident management, service issues, and usage queries.; ; A dedicated technical account manager or cloud support engineer is not provided as part of standard support. A named point of contact may be agreed for implementation and onboarding activities where specified in the Order Form.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Metadvice supports Buyers to start using the service through a structured onboarding and implementation process. This includes initial setup and integration with supported GP clinical systems, confirmation of information governance requirements, and configuration of agreed clinical modules and population health analytics.; ; Users are supported through online training materials and user documentation, including Instructions for Use available within the service.; ; Training is delivered remotely and focuses on how clinicians and teams use the service within existing workflows. Onsite training is not provided as standard.; ; During early adoption, Metadvice provides additional support to address questions, ensure users can access the service, and help embed it into routine clinical practice, in line with the Service Definition and Order Form.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
  • Other
• Other documentation formats:
  • Online training site
  • In-service Instructions for Use
• Documentation accessibility standard: None or don’t know
• How the documentation is accessible: Onboarding and offboarding documentation is provided through web-based documentation and downloadable files that can be accessed using standard desktop web browsers. Documentation is written in clear, structured language and can be viewed using built-in browser accessibility features such as zoom, text resizing, and screen contrast settings. Users may download and view documentation using their organisation’s standard tools. The documentation does not currently include alternative formats or formally tested assistive technology support beyond standard browser and operating system capabilities.
• End-of-contract data extraction: At the end of the contract, access to the Metadvice service is disabled in accordance with the Call-Off Contract. Metadvice does not act as the system of record for patient data, which remains within the Buyer’s source clinical systems.; ; Data processed by Metadvice is derived from routinely collected clinical records held in GP systems such as EMIS Web and TPP SystmOne, and no ongoing patient record changes are made by the service.; ; Where applicable and at the Buyer’s instruction, Metadvice can support the secure return or deletion of configuration data, audit information, or analytics outputs generated during the contract term, in accordance with the Data Processing Agreement.; ; All data handling at contract end, including retention, deletion, or return, is managed in accordance with the Data Processing Agreement and applicable data protection legislation.
• End-of-contract process: At the end of the contract, access to the Metadvice service is disabled in accordance with the Call-Off Contract. The Buyer’s patient data remains within the source clinical systems, and Metadvice does not retain ongoing access to those systems. Any data processed by Metadvice is handled in line with the Data Processing Agreement, including secure deletion or return at the Buyer’s instruction.; ; The contract price includes access to the Metadvice service for the agreed licence term, use of the configured clinical modules, standard support via email and ticketing during UK business hours, online training materials, documentation, and routine service updates and maintenance.; ; Additional costs may apply only where explicitly agreed in the Order Form. This may include optional implementation activities, bespoke configuration beyond the standard service offering, or support for specific Buyer requests outside the scope of standard service provision.; ; No ongoing charges apply after contract termination unless otherwise agreed, and there are no exit fees beyond those set out in the Order Form and Pricing Document.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Other
• Application to install: No
• Designed for use on mobile devices: No
• Service interface: Yes
• Description of service interface: Metadvice is accessed through a browser-based user interface designed for use by healthcare professionals. The interface is rendered either within supported GP clinical systems, such as EMIS Web or TPP SystmOne, or in a standard desktop web browser. It presents patient-level clinical decision support and population health analytics using clear, structured views. The interface is read-only with respect to the clinical record and does not write back to source systems. Navigation and outputs are designed to fit existing clinical workflows and support clinician interpretation and decision-making.
• Accessibility standards: None or don’t know
• Description of accessibility: Metadvice is accessed through a browser-based interface designed for use by healthcare professionals in desktop clinical environments. The interface uses standard browser controls, supports keyboard and mouse navigation, and is compatible with built-in browser accessibility features such as zoom and text resizing. Content is presented in clear, structured views to support readability and clinical interpretation. The service is not designed as a patient-facing application and does not currently offer configurable accessibility modes or formal assistive technology optimisation beyond standard browser capabilities.
• Accessibility testing: Metadvice has not carried out formal usability testing with users of assistive technologies. The service is designed for use by healthcare professionals in desktop clinical environments and relies on standard browser accessibility features. No specific testing has been undertaken with screen readers or other assistive technologies.
• User support accessibility: None or don’t know
• API: Yes
• What users can and can't do using the API: Yes. Metadvice provides application programming interfaces (APIs) to support secure data integration with supported GP clinical systems. APIs are used to access routinely collected clinical data required for analysis and to enable the service to operate within existing clinical workflows.; ; Buyers do not use the API to self-configure or deploy the service. Initial setup, configuration, and integration are carried out by Metadvice as part of implementation, working with the Buyer and relevant system suppliers under appropriate information governance approvals.; ; Users cannot make direct configuration changes, clinical rule changes, or data modifications through the API. The API does not support writing back to the clinical record, auto-prescribing, or altering source system data.; ; API use is limited to approved integrations with supported systems and is subject to access controls, contractual scope, and information governance requirements defined in the Call-Off Contract and Service Definition.
• API documentation: Yes
• API documentation formats: Other
• API sandbox or test environment: No
• Customisation available: Yes
• Description of customisation: Buyers can customise the service within defined parameters. Customisation includes selecting which clinical modules are enabled, defining population cohorts for analysis, and agreeing how analytics views are presented to support local workflows.; ; Customisation is carried out during implementation and ongoing use through configuration agreed with Metadvice, rather than through end-user system settings.; ; Customisation requests are typically made by nominated clinical or operational leads acting on behalf of the Buyer. Metadvice applies and validates configuration changes to ensure they remain clinically safe, guideline-aligned, and within the scope of the Service Definition and Order Form.

Scaling

• Independence of resources: Metadvice is delivered as a multi-tenant cloud-based service with logical separation between customer environments. Server-side resources are monitored and managed centrally, with capacity planning, performance monitoring, and load management in place to ensure consistent service availability. Resource allocation and scaling are handled by the underlying cloud infrastructure to prevent individual user demand from adversely affecting other users. Service availability and performance targets are defined in the Service Definition and SLA.

Analytics

• Service usage metrics: Yes
• Metrics types: Metadvice provides service usage metrics to support operational oversight. Metrics include user access and activity information, such as logins and module usage, as well as high-level system performance indicators and service availability. Usage information can support service monitoring, troubleshooting, and understanding how the service is being used across clinical teams. Metrics are provided in line with the Service Definition and do not include patient-identifiable data beyond what is necessary for service operation.
• Reporting types:
  • Regular reports
  • Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Supplier type

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Encryption of all physical media
• Data sanitisation process: Yes
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Data Erasure
• Equipment disposal approach: A third-party destruction service

Data importing and exporting

• Data export approach: Metadvice is not the system of record for patient data, which remains within the Buyer’s source clinical systems. As such, users do not export raw patient data directly from the service. Where required, and subject to information governance approvals, Metadvice can support the secure provision of agreed analytics outputs, reports, or configuration information generated during use of the service. Any data export is handled in accordance with the Data Processing Agreement and agreed through the Call-Off Contract.
• Data export formats:
  • CSV
  • Other
• Data import formats: Other
• Other data import formats: None - users do not upload data

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • Other
• Other protection within supplier network: Data within the Metadvice network is protected using encrypted connections and layered security controls. This includes network segmentation, access controls, and monitoring within the cloud environment, in line with Cyber Essentials Plus requirements. Security measures are applied centrally and maintained by Metadvice and its cloud hosting provider to protect data during processing and transmission within the service.

Availability and resilience

• Guaranteed availability: Service availability commitments are defined in the Service Level Agreement agreed at call-off. Availability is measured monthly, excluding planned maintenance notified in advance. Where availability falls below agreed levels, remedies are applied in accordance with the SLA and Call-Off Contract. Any service credits or refunds are handled as specified in the Order Form and Pricing Document.
• Approach to resilience: Metadvice is designed for resilience using cloud-based infrastructure with built-in redundancy and monitoring. The service is hosted on resilient cloud infrastructure that supports high availability through redundant components, automated monitoring, and managed recovery processes.; ; The underlying datacentre environment is operated by a third-party cloud provider and is designed to be resilient to hardware failure, network disruption, and other infrastructure-level incidents. Datacentre resilience, physical security, and environmental controls are managed by the hosting provider in line with recognised industry standards.; ; Metadvice monitors service health and performance and responds to incidents in line with documented incident management and support processes. Planned maintenance is managed to minimise disruption and communicated in advance where possible.; ; Detailed information about the underlying infrastructure resilience and datacentre design is managed by the hosting provider and can be made available to Buyers on request, subject to appropriate assurance and contractual arrangements.
• Outage reporting: Service outages are managed and communicated through operational support processes. There is no public status dashboard or outage reporting API. Where a service-impacting incident occurs, affected Buyers are notified via email by the Metadvice support team. Incidents are logged and tracked through the support ticketing system, with updates provided as appropriate until resolution.

Identity and authentication

• User authentication needed: Yes
• User authentication: Other
• Other user authentication: Users access Metadvice from within supported GP clinical systems. Authentication relies on the user being logged into the clinical system, with access controlled through the Buyer’s existing user management and role-based access controls. Only authorised clinical and operational users are able to access the service in line with local policies. Metadvice does not manage separate user credentials or modify source system authentication, and access is limited to individuals acting on behalf of the Buyer within the clinical system environment.
• Access restrictions in management interfaces and support channels: Access to management interfaces and support channels is restricted to authorised Metadvice personnel only. Role-based access controls are applied to ensure staff can access only the systems and information required for their role. Support requests are handled through controlled email and ticketing systems, with access limited to approved support staff. Administrative access is logged and monitored, and permissions are reviewed periodically. Buyers do not have direct access to service management interfaces, and all support activity is conducted in line with information governance and data protection requirements.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Other
• Description of management access authentication: Management access to the Metadvice service is restricted to authorised personnel and authenticated using secure credentials with multi-factor authentication. Access is role-based, ensuring staff have only the permissions required for their responsibilities. Administrative access is provided through controlled management interfaces protected by cloud platform security controls. All management access is logged and monitored, and permissions are reviewed periodically. Management access is separate from user access within GP clinical systems and is governed by documented internal security policies and procedures.

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Software Security Code of Practice: Yes
• Security governance certified: No
• Security governance approach: Metadvice approaches security governance through documented policies, risk management processes, and regular review of technical and organisational controls. Security responsibilities are clearly defined, with oversight of access control, incident management, vulnerability management, and secure development practices. The service is hosted on secure cloud infrastructure and aligned with recognised good practice, including Cyber Essentials Plus requirements. Security risks are assessed and mitigated on an ongoing basis, with external testing and assurance activities undertaken as appropriate. Data protection, clinical safety, and information governance requirements are embedded within service design and operation.
• Information security policies and processes: Metadvice follows documented information security policies and processes covering access control, data protection, incident management, risk management, secure development, and supplier assurance. Policies are reviewed regularly and updated to reflect changes in risk, regulation, or service operation.; ; Responsibility for information security sits with senior management, supported by designated leads for data protection and clinical safety. Security risks, incidents, and non-conformities are reported internally through defined escalation routes and addressed through corrective actions.; ; Compliance with information security policies is supported through technical controls, staff training and awareness, role-based access management, and monitoring of system activity. External assurance activities, including Cyber Essentials Plus certification and penetration testing, provide additional validation of controls.; ; Information governance, data protection, and clinical safety requirements are integrated into service design, onboarding, and ongoing operation, ensuring policies are applied consistently across the service and its supporting infrastructure.

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Metadvice manages configuration and change through documented internal processes. Service components, configurations, and releases are version-controlled and tracked throughout their lifecycle. Proposed changes are assessed for operational, clinical safety, and information security impact prior to release. Changes are reviewed, tested, and approved before deployment, with appropriate segregation of environments where applicable. Security risks are identified and mitigated as part of the change process, and changes are deployed in a controlled manner to minimise service disruption.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Metadvice manages vulnerabilities through documented internal processes. Potential threats are identified through monitoring of system logs, security alerts, external penetration testing, and review of supplier and industry security advisories. Vulnerabilities are assessed for risk and impact, prioritised based on severity, and addressed through timely remediation. Security patches and updates are tested and deployed in line with change management processes, with higher-risk issues addressed as a priority. Threat intelligence is informed by cloud provider notifications, industry best practice, and security guidance from recognised sources.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: Metadvice uses protective monitoring to identify potential security incidents through system logging, access monitoring, and automated alerts within the cloud environment. Logs and alerts are reviewed to detect unauthorised access, abnormal activity, or service anomalies. When a potential compromise is identified, it is assessed, contained, and investigated in line with incident management procedures. Appropriate corrective actions are taken, and affected Buyers are notified where required. Security incidents are responded to promptly, with higher-severity issues prioritised for immediate investigation and remediation.
• Incident management type: Supplier-defined controls
• Post-quantum cryptography secure: No
• Incident management approach: Metadvice operates documented incident management processes, including predefined procedures for common operational and security events. Users report incidents via email or the support ticketing system, where issues are logged, prioritised, and tracked through to resolution. Incidents are investigated by the support and technical teams, with corrective actions taken as required. Where appropriate, Buyers are informed of incidents and provided with updates or summary reports via email or ticket responses, in line with contractual and information governance requirements.

Secure development

• Approach to secure software development best practice: Supplier-defined process

Public sector networks

• Connection to public sector networks: Yes
• Connected networks: Health and Social Care Network (HSCN)

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 1.5%
• Between £1,000,001 and £2,500,000: 2%
• Between £2,500,001 and £5,000,000: 2.5%
• Over £5,000,001: 3%

Standards and certifications

• ISO/IEC 27001 certification: No
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber Essentials Certificate Number: 7a70c67a-fe6b-43d5-968e-f642a1300b77
• Cyber essentials plus: Yes
• Cyber Essentials Plus Certificate Number: 6b8d342a-bc2a-4c95-b05f-68593a7c1ecc
• Other security certifications: Yes
• Any other security certifications: NHS Data Protection and Security Toolkit (DPST) certification

Social value

• Mission: Build an NHS fit for the future:

  That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

  Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

  • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
  • Understanding barriers to access to health and social care services or employment opportunities e.g. digital inclusion

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at bhulme@metadvice.com. Tell them what format you need. It will help if you say what assistive technology you use.