MYWAY DIGITAL HEALTH LIMITED

MyWay Communications

MyWay Communications is a digital cohort-finding and patient communications service that helps NHS teams identify eligible patients and support uptake of NICE-recommended interventions. It uses patient records to generate clinician-reviewed referral lists and targeted digital messaging, improving access, increasing uptake and reducing administrative burden at scale.

Features

• Cohort finding using patient records and eligibility criteria
• Referral lists generated from primary care patient records
• Digital patient messaging via SMS and email
• Multi-wave messaging campaigns to support patient engagement
• Eligibility rules aligned to NICE-recommended interventions
• Integration with NHS GP systems including EMIS, Vision and SystmOne
• Secure handling of patient data with NHS governance controls
• Centralised campaign management and reporting
• Fully hosted, managed communications service
• Population-level reporting on engagement and uptake

Benefits

• Identify eligible patients quickly and consistently at scale
• Increase uptake of NHS and NICE-recommended services
• Reduce manual effort involved in patient identification and referrals
• Enable targeted patient communications without increasing staff workload
• Support proactive population health management initiatives
• Improve access to preventative and enhanced services
• Reduce administrative burden on primary care teams
• Standardise referral and engagement processes across services
• Save clinical time through automated cohort identification
• Provide clear insight into engagement and referral outcomes

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at louise.o'mahony@mwdh.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

199782543496766

Contact

Louise O Mahony
+44 (0)7463120512
louise.o'mahony@mwdh.co.uk

About your service

• Service categories:

  Applications

  Production and operations

  Service industry and public sector operations

  • Healthcare
• Multi cloud support: Yes

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: Can be standalone or add on: MyWay Communications can be used as a standalone service. It may also be used alongside other MyWay Digital Health services, such as MyWay Health or MyWay Clinical, where organisations wish to combine cohort identification, engagement and ongoing support.
• Cloud deployment model: Public cloud
• Service constraints: MyWay Communications is delivered as a fully hosted, managed SaaS service. Planned maintenance is scheduled to minimise impact on live campaigns. Support is provided during standard business hours. Use of the service is subject to local information governance approvals and patient consent. Messaging volumes and channels may be subject to third-party provider limits and costs. The service supports patient identification and engagement and does not guarantee patient uptake or behavioural outcomes.
• System requirements: Modern web browser

User support

• Email or online ticketing support: Yes
• Support response times: Immediate automated response with a 48 hour resolution
• User can manage status and priority of support tickets: No
• Phone support: No
• Web chat support: No
• Onsite support: No
• Support levels: MyWay Communications provides a structured support model appropriate to a managed, cloud-based NHS service.; ; Standard Support is included in the service price. This provides email-based support during UK business hours for service queries, configuration questions, incident reporting, and operational support. Requests are triaged by severity, with service-impacting issues prioritised. User guidance and documentation are also provided.; ; Enhanced Support is not offered as a separate tier. All customers receive the same standard level of support to ensure consistent service delivery and governance.; ; There is no additional cost for support beyond the contracted service price. Support costs are included within the overall service fee.; ; MyWay Communications is delivered as a fully managed service. Customers are supported by a dedicated delivery and support team, including access to a named service contact who coordinates support, configuration, and ongoing service delivery. This role provides continuity and acts as the primary point of contact but is not a full technical account manager.; ; Cloud infrastructure support and technical issue resolution are provided by the MyWay Digital Health technical team. Customers do not require direct access to a cloud support engineer.
• Support available to third parties: No

Onboarding and offboarding

• Getting started: Case finding criteria, referral pathways, and reporting outputs are customised to reflect local population needs, service configurations, and commissioning priorities. This includes tailoring eligibility logic, referral destinations, data capture fields, and reporting formats so outputs align with local processes and information requirements.
• Service documentation: No
• End-of-contract data extraction: MyWay Communications is delivered as a managed cohort-finding and patient communications service. Data processing, referral generation, and reporting are carried out by MyWay Digital Health as part of the service, rather than through a user-facing data access or export function.; ; Commissioners receive service-level reports during the contract term, such as uptake and engagement reporting, as part of ongoing service delivery. These reports are provided by MyWay Digital Health and are not generated through a self-service export capability.; ; At contract end, access to the service is removed. Data is retained and securely deleted in line with contractual terms, data sharing agreements, and information governance requirements. There is no self-service, manual, or automated data extraction provided to users.
• End-of-contract process: At the end of the contract, MyWay Communications follows a standard end-of-contract process.; ; On contract expiry, delivery of cohort finding, referral generation, and patient communications ceases, and customer access to the service is removed. No further patient communications or reporting are generated after the contract end date.; ; The contract price includes delivery of the MyWay Communications service for the duration of the contract, including configuration, cohort identification, referral list generation, digital communications, and provision of agreed service-level reports (such as uptake and engagement reporting).; ; There are no additional charges associated with the standard end-of-contract process.; ; Following contract termination, data is retained and securely deleted in accordance with data sharing agreements, patient consent, and information governance requirements. Users do not extract data from the service at contract end.; ; Any work requested outside the scope of the contracted service, such as extensions to the contract term or additional communications activity beyond the agreed period, would be subject to separate agreement and pricing.

Using the service

• Web browser interface: No
• Application to install: No
• Designed for use on mobile devices: No
• Service interface: No
• User support accessibility: None or don’t know
• API: No
• Customisation available: Yes
• Description of customisation: MyWay Communications can be fully customised to support local case finding, referral generation, and reporting requirements.; ; What can be customised; Case finding criteria, referral pathways, and reporting outputs are customised to reflect local population needs, service configurations, and commissioning priorities. This includes tailoring eligibility logic, referral destinations, data capture fields, and reporting formats so outputs align with local processes and information requirements.; ; How users can customise; Customisation is delivered in collaboration with the customer during onboarding and service setup. We configure the service based on agreed local requirements, ensuring that workflows and reporting reflect the local operating model. Changes can be made over time to respond to evolving needs, with updates managed through structured change requests.; ; Who can customise; Customisation is carried out by our delivery and technical teams in partnership with authorised stakeholders from the customer organisation, such as service leads or commissioners. This ensures all configuration is clinically and operationally appropriate while remaining consistent with governance and data standards.; ; This approach ensures MyWay Communications is 100% tailored to the local area while remaining reliable, scalable, and compliant.

Scaling

• Independence of resources: MyWay Communications is delivered as a planned, managed service. Patient communications campaigns are scheduled in advance to manage demand and ensure reliable delivery.; ; Capacity is planned to support agreed volumes, and additional campaigns can be added by agreement without affecting existing activity. This approach ensures that demand generated by one customer or campaign does not negatively impact delivery for others.

Analytics

• Service usage metrics: Yes
• Metrics types: We provide service usage metrics as part of MyWay Communications. Metrics include campaign performance measures such as message delivery, open rates, click-through rates, and referral or uptake rates, where applicable.; ; Metrics are provided in aggregate form to support service monitoring and evaluation.
• Reporting types: Regular reports
• Resource tagging: Yes
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest: Physical access control, complying with CSA CCM v4.0
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type: Data Erasure

Data importing and exporting

• Data export approach: Users do not export their data from the service. Data export is not part of this service.
• Data export formats: Other
• Other data export formats: Data exports are not available
• Data import formats: Other
• Other data import formats: Data imports are not available

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: The service has a guaranteed availability of 95%.; ; This availability level acts as a contractual backstop. Actual availability typically exceeds this level, but only the guaranteed level is committed to.; ; Service level agreements (SLAs), including how availability is measured and any applicable service credits or remedies, are defined within locally agreed contracts. Where availability falls below the guaranteed level, remedies and any refunds are applied in accordance with the terms of the relevant contract.
• Approach to resilience: Available on request
• Outage reporting: As the service is delivered through planned activity rather than continuous user access, outage reporting is handled through direct communication rather than automated alerts.

Identity and authentication

• User authentication needed: Yes
• User authentication: Multi-Factor Authentication (MFA)
• Access restrictions in management interfaces and support channels: Access to management interfaces and support channels is restricted to authorised personnel only.; ; Support and administrative access is controlled using named user accounts with authenticated access. Permissions are assigned based on role, ensuring staff only have access to the systems and information required to perform their duties.; ; Access controls are reviewed regularly, and access is removed promptly when roles change or staff leave. Activity within management interfaces and support systems is logged to support monitoring and audit.; ; This approach ensures that management and support access is secure, controlled, and traceable.
• Access restriction testing frequency: At least once a year
• Management access authentication: Multi-Factor Authentication (MFA)

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: Next MyWay Digital Health Ltd operates an ISO/IEC 27001:2022-certified Information Security Management System (ISMS). Our approach is aligned with the NHS Data Security and Protection Toolkit (DSPT), Cyber Essentials, and UK GDPR requirements.; ; Our information security policies cover key areas including access control, asset management, risk management, secure development, incident response, business continuity, cryptography, and supplier security. All policies are version-controlled and maintained within our Quality Management System (QMS).; ; Governance and oversight are provided through our QMS Forum, which conducts quarterly reviews. This forum approves policy updates, reviews security incidents, and oversees risk management activity.; ; Policy compliance is ensured through structured onboarding, mandatory annual ISMS training, staff declarations, and assessment quizzes. Ongoing assurance is provided through internal audits, penetration testing, regular system monitoring, and automated access logging using Azure B2C and Microsoft Sentinel.; ; Non-conformities and risks are recorded in the ISMS Risk Register and managed through corrective and preventive action (CAPA) processes. Security incidents are triaged, investigated, and reported in line with policy. Any personal data breaches are escalated and reported within 72 hours in accordance with GDPR Article 33.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: All platform components are tracked throughout their lifecycle via Azure DevOps and internal registers, with each item tagged to environments, version history, change logs, and test coverage. Changes are formally logged via a structured template and triaged weekly based on impact, urgency, and risk. Security implications are evaluated for every change using an ISO 14971 and DCB0129 based risk assessment process. Clinical and data security risks are flagged for RAQA review. All production changes require pre-deployment review and senior approval, with rollback plans in place. Change audit trails are maintained for traceability, aligned with our ISO 27001 and ISO13485 certifications.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: Our vulnerability management approach aligns with ISO/IEC 27001:2022 and NHS DSPT requirements. Threats are assessed through continuous internal monitoring, NHS Digital alerts, vendor advisories (e.g. Microsoft, Azure), and external intelligence sources including NCSC, SANS, and ISC2. Identified vulnerabilities are risk-assessed for likelihood and impact under our Threat Intelligence & Risk Management SOP. Medium-risk issues are addressed within standard maintenance windows (typically within 14 days). Critical vulnerabilities may trigger emergency patching under formal Change Control. All threats are logged by the RAQA Manager, reviewed jointly with the Development Manager and DPO, and validated via quarterly internal audits and annual penetration testing.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: Protective monitoring is handled by an ISO 27001-certified third-party provider who performs 24/7 logging, anomaly detection, and alerting. This includes monitoring for unauthorised access, system anomalies, and potential compromises. All high-risk alerts are escalated per SLA, with response triage initiated within 1 hour. Monthly monitoring reports are reviewed internally and stored in our ISO 13485-controlled QMS. Confirmed incidents trigger our Incident Response SOP, which includes containment, root cause analysis, and CAPA. Ongoing oversight is provided by the DPO and RAQA Manager. Monitoring coverage and incident trends are reviewed quarterly as part of our internal audit cycle and management review.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: We have a documented incident management process aligned with ISO 27001 and ISO 27035, covering predefined procedures for events such as data breaches, system outages, malware infections, and access violations. Users report incidents via a digital ISMS Incident Reporting Form, which routes automatically to the Regulatory team for triage and classification. Each incident is logged, assessed, and resolved with defined roles and escalation paths. Post-incident reviews and corrective actions are recorded in the CAPA log. Formal incident reports are shared with affected stakeholders and clients on request, and breach notifications follow ICO and NHS DSPT protocols where applicable.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 0%
• Between £2,500,001 and £5,000,000: 0%
• Over £5,000,001: 0%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: LRQA
• ISO/IEC 27001 accreditation date: Friday 4 August 2028
• What the ISO/IEC 27001 doesn’t cover: Our ISO 27001 certification scope excludes physical premises controls, as MyWay Digital Health Ltd operates as a fully remote organisation without centralised office infrastructure. Infrastructure is managed by our third-party infrastructure provider, who maintains their own ISO 27001:2022 certification. All logical access and monitoring, data handling, development, and support processes under our direct control are fully covered by our certification.
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 1b4aac2e-f918-4fcc-abed-ba8974eb28da
• Cyber essentials plus: No
• Cyber Essentials Alternative: In relation to the services you do not have a current and valid Cyber Essentials Plus certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials Plus certificate by one of the government approved accreditation bodies within 12 months of the date of award.
• Other security certifications: Yes
• Any other security certifications:
  • NHS DSPT
  • DTAC

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
    • Understanding barriers to access to health and social care services or employment opportunities e.g. digital inclusion
    • Inclusive and accessible recruitment practices, development practices and retention policies that support-focused activities including those provided in the Guide for line managers on recruiting, managing and developing which support people with a disability or health condition
    • Actions to invest in the physical and mental health and wellbeing of the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at louise.o'mahony@mwdh.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.