DBROTAS LTD

dbRotas

dbRotas is a specialised web based rostering system that can auto-generates bespoke clinician rosters around requests, preferences, training needs and service provision.
dbRotas also provides a location based rostering service that auto-generates clinician to different clinical locations and reports on daily activities.

Features

• Auto-generation of bespoke clinician rotas
• Leave management and system
• Automated locum generation
• Self rostering facility
• Training program allocation
• Real time compliance checking
• Exception reporting system
• Automated location based rostering
• Location reporting
• Job Planning

Benefits

• Reduction in time to generate rosters
• Improved morale and wellbeing of clinicians
• Improved rostering of less than full time clinicians
• Fair allocation of leave for clinicians rotating through departments
• Improved attendance for clinicians to attend training programs
• Reduction in locum requirements to cover gaps
• Real time alerts of potential contractual compliance violations
• Optimization of staffing levels across a department and locations
• Automatic clinician notification regarding shift/location changes
• Easy to access job plans and roster on multiple devices

• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at help@dbrotas.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

194376561792942

Contact

Daniel Barry
07804594823
help@dbrotas.com

About your service

• Service categories:

  Applications

  Enterprise resource management

  Human capital management

  • Core Human Resources Applications
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model: Private cloud
• Service constraints: Requires internet connection and browser to view rotas; Planned maintenance and updates are primarily out of hours
• System requirements: Web Browser e.g Chrome/Firefox/Safari

User support

• Email or online ticketing support: Yes
• Support response times: Within 1 business day . ; Support provided 7 days a week
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: None or don’t know
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: The following is included as part of the licence fee: Virtual meetings or telephone consultations can be organised directly through the platform via the booking system into client/end user chosen time/dates.; Virtual meeting links will then be sent to the designated individuals.; Email support available to all.; Technical account manager assigned to each department for continuity.; In person teaching/setting up service available for an additional fee.
• Support available to third parties: No

Onboarding and offboarding

• Getting started: The following is included as a part of the licence fee:; End user (administrator) and client: Initial introduction meeting with clients/administrators regarding the set-up of clinicians on the rotas, work schedules and shifts with a brief overview of the live system.; This will be accompanied with a how-to written guide with a checklist.; Subsequent meeting covers the generation of the rota the live system functionality.; Last meeting covers a debrief of any areas for feedback and bespoke alterations.; At any point along the way if are any questions not covered in the above, the appointment system can be used for a support call or email for advice.; End user (clinician): A set by step how to guide in written form or an alternative in video format. Email support available on request.; Onsite training can be arranged for an additional extra fee.
• Service documentation: Yes
• Documentation formats: PDF
• End-of-contract data extraction: The contract includes the export of current live rotas as .pdf file to include shifts, locums, locations and logs to the end of the contract.; Data sanitation occurs as per terms and conditions and agreement.
• End-of-contract process: The contract includes the export of current live rotas as .pdf file to include shifts, locums, locations and logs to the end of the contract.; Data sanitation occurs as per terms and conditions and agreement.
• Documentation accessibility standard: WCAG 2.2 A

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Mobile site can be accessed by end users (clinicians) to view shifts, submit leave requests, request shift swaps and apply for locum shifts. End users (administration) is best done on a desktop screen, but administrators can view the rota and approve shifts/message users on a mobile device.
• Service interface: Yes
• User support accessibility: WCAG 2.2 A
• Description of service interface: DbRotas service interface features a landing page with a series of dropdown options from a main menu.; Pages throughout the site contain different customisable administrator settings for end users (clinicians), rotas (shifts and dates) which are displayed in tables. Live rotas or locations are displayed in tables that permit users to make amendments with a log of changes. Personalised view options available for each administrator.
• Accessibility standards: WCAG 2.2 A
• Accessibility testing: DbRotas has performed testing with consideration for end users/administrators and offers end users personalisation/options to improve their accessibility as per WCAG 2.2 A.; This includes but is not limited to the personalisation of:; - Text colour; - Font size; - Zoom without loss of functionality; - Video, audio or written assistance for support; - Accessibly by keyboard only use
• API: Yes
• What users can and can't do using the API: The dbRotas API provides read-only access to shift and rota data to support integration with external systems.; ; What users can do using the API; ; Users are issued with an API key by the platform, which is used to authenticate requests.; ; Once access is enabled, users can retrieve shift and rota data for their organisation.; ; The API allows querying shifts by date range, department, or clinician identifier.; ; Retrieved data can be exported to external systems such as payroll, workforce planning, or reporting platforms.; ; The API enables automated, scheduled data synchronisation to reduce manual exports.; ; What users cannot do using the API; ; Create, edit, or delete shifts, rotas, or leave records.; ; Make any changes to dbRotas configuration, rota rules, or approval workflows.; ; Create or manage users, departments, or organisational settings.; ; Access data outside the organisation linked to their API key.; ; Limitations; ; The API is strictly read-only.; ; Access is limited to the scope and permissions associated with the API key.; ; Rate limits apply to ensure system stability and availability.
• API documentation: Yes
• API documentation formats:
  • HTML
  • PDF
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Multiple facets of the platform can be customised both by administrators and end users.; Each end user (clinician and administrator) has a preferences section for their account regarding their accessibility and notifications options.

Scaling

• Independence of resources: Cloud based architecture with scalability and load balancing.

Analytics

• Service usage metrics: Yes
• Metrics types: Statistics covering the following domains:; - Leave approval; - Sickness /absence; - Locum requirement and filled rates; - Location based utilisation; - Exception reporting; ; Comprehensive package bespoke to departmental or trust wide needs. Further service metrics are available on request for an additional fee.
• Reporting types: Real-time dashboards
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: None

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
• User control over data storage and processing locations: No
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest: Physical access control, complying with another standard
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type: Explicit overwriting of storage before reallocation / Secure Erase

Data importing and exporting

• Data export approach: End users (clinicians) can export their data as an .ICS file to allow export to other calendar devices.; Administrators can export the rotas as a .pdf for printing.
• Data export formats: Other
• Other data export formats:
  • PDF
  • ICS
• Data import formats: Other
• Other data import formats: PDF

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: 0–10 hours: No refund.; 10–24 hours: 30% of monthly payment.; >24 hours: 100% of monthly payment.
• Approach to resilience: Available on request.
• Outage reporting: System monitoring services in place that ensure any downtime is highlighted quickly via a dedicated dashboard on the site.; In the event of an outage each end user (clinican, rota administrator, client) will be informed via email and updated and if requested, a pdf of the most recent backup of the rota.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password
• Access restrictions in management interfaces and support channels: The system provides the client multiple levels of privileges to data access and utilises the role-based access control model (RBAC). Each user is allocated a corresponding level of data access using the principle of least privilege to assign privileges dependent on the users’ role, seniority and department.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: No
• Security governance approach: DbRotas system is ‘secure by design’. The full details of the information security governance policy can be sent to interested parties upon request. The appointed security and data protection officer undertakes quarterly audits of the parameters in the security governance policy, team and client. Risk management by the appointed team occurs as a part of change management on potential impact and likelihood of occurrence and implementing appropriate controls to manage them effectively.
• Information security policies and processes: DbRotas is ‘secure by design’. Information security forms a part of the information security governance policy that is available to interested parties upon request.; Quarterly audits are undertaken by the appointed security and data protection officer to ensure the information security policy is upheld to include risk assessments of current and potential change, data access (team and client), processing, transfer, storage and sanitation. In the event of a security breach all affected users will be informed via email.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: DbRotas configuration and change management approach utilise a change request tool. This can be sent to interested parties upon request. The main headings are: change request, reason to change, impact and risk assessment tool to continue and to change and security assessment. The change management team review requests and use a closed loop communication to the change request. These are logged and audited.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: DbRotas regularly monitors for vulnerabilities and aims to identify vulnerabilities early, tirage and mitigate risk.; Rating of vulnerability is classified and addressed within the following timeframes:; - Red risk: patch repair to be deployed within 7 calendar days.; - Orange risk: patch repair to be deployed within 14 calendar days.; - Yellow risk: patch repair to be deployed within 30 calendar days.; These are aligned with the National Vulnerability Database Vulnerability Severity ratings (red- high, orange - medium and yellow - low).
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: DbRotas undertakes quarterly audits undertaken of reports of potential compromise and annual penetration testing.; Real time threat information and alerts provided by Cloud provider.; Response to potential compromise follows the information security policy that is available upon request.; Responses to incidents occur within 24 hours of potential breaches.
• Incident management type: Supplier-defined controls
• Incident management approach: Incidents can be reported by clients or end users ( clinicians or administrators) using the inbuilt reporting system. These are responded to by the security and data team using the incident reporting tool that utilises closed loop communication. These are emailed back to the reporting user.; Communication to affected users will be via email, telephone or virtual meeting within 24 hours, ICO update as required along with regular updates on the dashboard to inform of updates.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Supplier-defined process

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: Yes
• Description of free trial: Free trial of system includes the set up, generation and live system use of one roster/set of rosters in a department.

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 5%
• Between £250,000 and £500,000: 7.5%
• Between £500,001 and £1,000,000: 10%
• Between £1,000,001 and £2,500,000: 12.5%
• Between £2,500,001 and £5,000,000: 15%
• Over £5,000,001: 17.5%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: No
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 8f6a4cf7-150f-48cc-9f78-a2b48848b0b3
• Cyber essentials plus: No
• Cyber Essentials Alternative: None of the criteria
• Other security certifications: Yes
• Any other security certifications: Data Security and Protection Toolkit

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
    • Inclusive and accessible recruitment practices, development practices and retention policies that support-focused activities including those provided in the Guide for line managers on recruiting, managing and developing which support people with a disability or health condition

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at help@dbrotas.com. Tell them what format you need. It will help if you say what assistive technology you use.