EQL LIMITED

PHIO Prevent

Phio Prevent is a digital musculoskeletal wellbeing and prevention service that helps individuals reduce injury risk, manage early symptoms, and build healthy movement habits. It delivers personalised, clinically informed content and early interventions, supporting proactive MSK health while reducing avoidable demand on clinical services.

Features

• Scalable web-based MSK prevention platform for population-level deployment
• Personalised preventative content using rules-based and behavioural data
• Secure cloud-hosted infrastructure aligned with NHS information governance standards
• Flexible integration options supporting optional pathway escalation
• Population-level engagement reporting with real-time cohort analytics
• Configurable content, branding and campaigns for diverse population groups
• Lightweight assessments identifying MSK risk trends across cohorts
• Early intervention support designed to reduce avoidable downstream care costs
• Browser-based access enabling rapid rollout without software installation

Benefits

• Reduce avoidable MSK demand through proactive population-level prevention
• Improve workforce productivity by supporting early self-management behaviours
• Enable rapid rollout of preventative programmes without technical deployment burden
• Support consistent MSK messaging across large and diverse user populations
• Identify emerging MSK risks early across cohorts
• Reduce pressure on clinical services through early digital intervention
• Deliver preventative content efficiently without face-to-face resource requirements
• Monitor engagement and trends without manual data collection
• Improve user access to MSK support outside traditional service hours

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at info@eql.ai. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

224308686432980

Contact

Jason Ward
07884008770
info@eql.ai

About your service

• Service categories:

  Applications

  Production and operations

  Service industry and public sector operations

  • Healthcare
  • Public Order and Safety
  • Police
  • Defence
  • Social Security Administration
  • Other
• Multi cloud support: No

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: Phio Access, Phio Engage, Phio Collect
• Cloud deployment model: Private cloud
• Service constraints: Internet Access via a modern web browser, further constraints can be covered in SLAs at time of contracting.
• System requirements: Internet connection A modern internet browser

User support

• Email or online ticketing support: Yes
• Support response times: Within 48 hours (Mon-Fri)
• User can manage status and priority of support tickets: No
• Phone support: No
• Web chat support: No
• Onsite support: No
• Support levels: EQL provides onboarding support for Phio Access for the initial phase. This integration team comprises clinical representatives (qualified Physiotherapists), operations support, customer success manager, engineering, governance (clinical and information), and where appropriate GP liaison support. They will discuss all integration routes and confirm which route is most appropriate. The integration team will be on hand throughout the onboarding process to provide staff training, governance set up, project management, operational & technical support. EQL clinical representatives will work with all necessary clinical stakeholders to configure the decision tree. This includes pathway mapping and exit points, ensuring the unique instance of Phio Access reflects local frameworks and desired clinical outputs inclusive of patient communication (i.e. defining appropriate messaging for a given pathway outcome). EQL are also able to provide ongoing clinical support via our internal Clinical Services Team in order to oversee the whole triage function and, where appropriate, review outcomes to ensure appropriate pathway placement. Phio Access is provided as a fully managed service and requires relatively little ongoing support. However, our post-onboarding service includes personal account management support and ongoing KPI’s. We also provide online support to end users of the platform for any technical support that might be required.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: EQL supports customers through a structured onboarding process to ensure Phio Prevent can be adopted quickly and used effectively at scale.; Getting started typically begins with a discovery and setup phase, during which EQL works with the customer to understand target populations, objectives, governance requirements and success measures. Branding, content focus and campaign configuration are agreed and implemented by EQL prior to go-live, removing the need for technical setup by the customer.; Training may include online onboarding sessions for service managers, wellbeing leads or digital teams, covering service scope and operational processes. Supporting documentation is provided to enable internal stakeholders to understand how the service works and how it fits within existing pathways.; End users do not require formal training. Phio Prevent is designed to be intuitive and accessible, with clear user journeys, simple language and guided interactions. Access is typically provided via web links or existing communication channels, enabling rapid rollout without software installation.; Following launch, EQL provides early-phase support to monitor adoption, resolve issues and optimise engagement. Ongoing support and service reviews are available to ensure the service continues to meet organisational needs over time.; This approach enables fast, low-burden implementation while maintaining consistency and quality.
• Service documentation: Yes
• Documentation formats: PDF
• End-of-contract data extraction: All outstanding data (not previously provided to them) is provided to the user via their integration route; either API or Admin Portal.
• End-of-contract process: Our service for the specific customer goes offline and no new patients are allowed access to the service. We ensure the customer has been provided all outstanding data. We keep all patient data for the customer for the timeframes assigned in our data retention policy.
• Documentation accessibility standard: None or don’t know
• How the documentation is accessible: N/A

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: No
• Service interface: Yes
• User support accessibility: WCAG 2.2 AA
• Description of service interface: API's & Admin Portal our clients use to interact with our services
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: N/A
• API: Yes
• What users can and can't do using the API: Users can use our suite of API endpoints to refer a patient to Phio Access and retrieve completed Phio Access data.
• API documentation: Yes
• API documentation formats: Open API (also known as Swagger)
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Phio Prevent is designed to be configurable to meet the needs of different organisations, populations and use cases, without requiring software development or technical expertise from users.; Organisations can customise the service across several areas, including branding, content focus, campaign structure and eligibility rules. User-facing elements such as logos, colour schemes and introductory messaging can be configured to align with organisational identity. Preventative content themes can be prioritised or curated to reflect specific population needs, for example workplace ergonomics, desk-based activity, manual handling, recovery, or lifestyle factors.; Customisation is managed as part of the onboarding and ongoing service delivery process, led by EQL in collaboration with the customer. Configuration changes are agreed through defined governance and change-control processes, ensuring consistency, clinical safety and alignment with organisational objectives. Campaigns can be refreshed over time to align with internal wellbeing initiatives or seasonal priorities.; Customisation is typically requested by authorised organisational stakeholders such as service managers, wellbeing leads, commissioners or digital leads, and implemented by EQL. End users do not customise the service themselves; individual-level personalisation is handled automatically by the platform based on user interaction and behaviour.; This approach enables controlled, scalable customisation while maintaining clinical governance and operational consistency.

Scaling

• Independence of resources: We have load balances in place that help distribute the load on a single server.

Analytics

• Service usage metrics: Yes
• Metrics types: Monthly MI which includes key data metrics such as; Total Referral Count, Completion Rate, Outcome Breakdown, Age Demographic and Injured Area Data Analysis.
• Reporting types:
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: None

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: European Economic Area (EEA)
• User control over data storage and processing locations: No
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest:
  • Scale, obfuscating techniques, or data storage sharding
  • Other
• Other data at rest protection approach: We use a 3rd party service provider, Google Cloud Platform, and therefore benefit from all of their security polices and protocols.
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type: Explicit overwriting of storage before reallocation / Secure Erase

Data importing and exporting

• Data export approach: This is dependent on the user’s integration route. This could be either via API or our Admin Portal rendering each patient’s data into PDF format.
• Data export formats:
  • CSV
  • Other
• Other data export formats:
  • PDF
  • JSON
• Data import formats: Other
• Other data import formats: JSON

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • Other
• Other protection within supplier network: Access control layers which limits/controls access to data within our network.

Availability and resilience

• Guaranteed availability: We work to maintain a high level of availability at 95%. Our approach is to minimise downtime to provide consistent access to our services.; ; In the rare event that our services become unavailable, we work with customers to resolve issues promptly. Our customer support team is available to support customers, ensuring quick communication and timely issue resolution.
• Approach to resilience: Our service is designed to run on Google Cloud Platform (GCP). GCP utilises the byzantine fault tolerant technique to replicate servers into zones. As these zones are isolated from each other it is highly unlikely that all zones fail from the same cause and at the same time.
• Outage reporting: We are notified of any outages via GCP's zone status API. We report any outages to our customers via email alerts to our key contacts.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Public key authentication (including by TLS client certificate)
  • Username or password
  • Other
• Other user authentication: Users can access the service via multiple routes these all have different authentication. When customers access the service via API they are authenticated by unique key authentication and data match requirements. When customers access the service via Admin Portal they are authenticated by Username & Password requirements. When a patient (end user) access the service they are authenticated via a JSON web token for Phio Triage.
• Access restrictions in management interfaces and support channels: Our management interface is restricted by layered access levels. This ensures members of staff are only provided access to the level of data required to successfully complete their job while at the same time restricting them from any access not required for their job. This allows us to protect the data.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Username or password
  • Other
• Description of management access authentication: Internal management are provided access to the Admin Portal service via personal username and passwords that are subject to our password policy which involves passwords being changed every 90 days.

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: We follow our own internal information security policies and processes. These include Information Classification, Security Awareness & Training, Acceptable Usage, Access Controls, Password Policy, Physical Security, Protecting Data in Transit and at Rest, Disposal of Data, Data Protection by Design etc. We hold various security accreditations including Cyber Essentials, Cyber Essentials Plus, and ISO27001.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: Change management is handled without our QMS system. All requirements are kept up to date and are fully traceable throughout the lifecycle of the change and archived for future reference if required. All requirements are to be reviewed and signed off by both our Data Security Officer and our Clinical Safety Officer in line with DCB 0129
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: EQL operates a structured vulnerability process to identify, assess, and remediate potential threats to its services. Potential vulnerabilities are identified through regular penetration testing, security assessments, and ongoing monitoring of systems and infrastructure. Threats are assessed based on risk, impact, and likelihood to determine appropriate remediation actions.; Security patches and fixes are deployed with defined service level agreements, with critical vulnerabilities prioritised for rapid remediation. EQL’s enables timely deployment of patches without unnecessary service disruption. Information about emerging threats is obtained from penetration testing partners, cloud service provider security advisories, industry best-practice guidance, and relevant security and vulnerability disclosure channels.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: All our exposed services (available on the internet) utilise GOOGLE FRONT END as reverse proxy. This layer also provides real time threat detection. When a potential risk is identified we have settings in place to temporarily disable the service involved or, as in the case of a DoS attack, our system intelligently throttles inbound requests.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: EQL operates a formal incident management process with its Security Incident Management and Data Breach policies. Pre-defined procedures are in place to manage common incident types, including security events, service availability issues, and data protection incidents.; Incidents can be reported via a dedicated business email contact and are logged/tracked/managed through incident management processes. Each incident is assessed, prioritised, and responded to based on severity and impact. Business continuity and recovery plans are maintained to support service resilience during major incidents.; Incident reports, including root cause analysis and remedial actions, are provided to customers with contractual and regulatory requirements.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Conforms to a recognised standard, but self-assessed

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 2.5%
• Between £250,000 and £500,000: 5%
• Between £500,001 and £1,000,000: 7.5%
• Between £1,000,001 and £2,500,000: 10%
• Between £2,500,001 and £5,000,000: 12.5%
• Over £5,000,001: 15%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: British Assessment Bureau
• ISO/IEC 27001 accreditation date: Friday 23 February 2024
• What the ISO/IEC 27001 doesn’t cover: Nil
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: D156c415-17a5-48cd-962d-ec1787e5e41b
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: 76022c2e-61b2-4b7c-bc3c-934d09dd210b
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

    • Activities to support relevant sector related skills growth and sustainability in the contract workforce. Illustrative examples: careers talks, curriculum support, literacy support, safety talks and volunteering

  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
    • Understanding barriers to access to health and social care services or employment opportunities e.g. digital inclusion

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at info@eql.ai. Tell them what format you need. It will help if you say what assistive technology you use.