TACTUUM LTD

Quris Healthcare Platform

Quris Healthcare Platform provides two core capabilities (1) Clinical Companion: clinical resources (guidelines, patient information, protocols, policies) management and digital delivery, and (2) Patient Companion: remote patient monitoring using device data, PROMS, PREMS and questionnaires. The modules can be used separately or as an integrated bundle.

Features

• offline working
• remote working
• FHIR openEHR support
• AI integrated support
• Support for PROMS, PREMS
• Support for clinical pathways
• Support for clinical guidelines

Benefits

• Integrated patient and clinician data/information
• Publish clinical resources to multiple devices
• Usable on web and mobile or integrated into EHR
• Manage wide range of clinical and patient resources
• Can be used/accessed offline on mobile devices

• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at mbuchner@tactuum.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

248635539184069

Contact

Mark Buchner
07966687683
mbuchner@tactuum.com

About your service

• Service categories:

  Applications

  Content workflow and management

  • Document

  Content services

  • Enterprise Content Management Applications
  • Content Sharing and Collaboration Applications

  Persuasive content management

  • Website Software
  • Digital Asset Management Applications
• Multi cloud support: Yes

Service scope

• Software add-on or extension: No
• Cloud deployment model:
  • Public cloud
  • Private cloud
• Service constraints: Designed primarily for Microsoft Azure and Amazon AWS platforms.
• System requirements: None

User support

• Email or online ticketing support: Yes
• Support response times: Mon-Fri 09:00-17:00; Critical: <1hr; High: <4hr; Medium: <8hr; Low: <16hr; (extended support, e.g. 24/7 is available at additional cost)
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AA
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: Yes
• Web chat support availability: 24 hours, 7 days a week
• Web chat support accessibility standard: WCAG 2.2 AA
• Web chat accessibility testing: Our chatbot support capability has been tested through web chat sessions involving assistive technology users, assessing compatibility with screen readers, keyboard interaction, and accessible focus management. This has been conducted by our internal testing team who are formally trained on assistive technology and accessibility needs.
• Onsite support: No
• Support levels: We provide triaged (critical, high, medium, low) support for the application delivered directly to clients. Every client is assigned a dedicated account manager. There are no additional costs associated with this.
• Support available to third parties: Yes
• AI chatbot: Yes

Onboarding and offboarding

• Getting started: Onsite and/or online training is available in multiple formats, e.g. train-the-trainer, group sessions. User documentation and help/FAQ are provided online via the support portal. We have a documented onboarding process that is followed for each new client.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: Data can be extracted via the RESTful API services (patient data) or downloaded in HTML or PDF formats (clinical resources).
• End-of-contract process: The process of extracting/downloading data/content from the system is built into the Quris platform but it is the responsibility of the client to perform these activities before contract end. There is no additional cost associated with this.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: There are no functional differences. The design/style are consistent across mobile and web. The only practical difference is in terms of layout and navigation using a responsive design for mobile.
• Service interface: No
• User support accessibility: WCAG 2.2 AA
• API: Yes
• What users can and can't do using the API: Data extraction through secure, encrypted RESTful API using FHIR-based messaging is available (no additional cost).
• API documentation: Yes
• API documentation formats:
  • Open API (also known as Swagger)
  • HTML
  • PDF
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Customers can customise the brand of the platform and all of the content (e.g. clinical guidelines, pathways, patient resources, questionnaires for PROMS/PREMS, etc.).

Scaling

• Independence of resources: The system architecture utilising scaling-up (i.e. improved resource plan capabilities within cloud infrastructure) and scaling-out (i.e. additional multiple resources). Our system is regularly load-tested for 50%, 100% and 200% above current capacity loads.

Analytics

• Service usage metrics: Yes
• Metrics types: System use is captured through internal mechanisms and available via system dashboards/reports.; Content use is captured (web and mobile) via Google Analytics and is available through the clients own login.
• Reporting types:
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: Yes
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: NCSC approved service provider
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Encryption of all physical media
• Data sanitisation process: Yes
• Equipment disposal approach: A third-party destruction service
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Data Erasure

Data importing and exporting

• Data export approach: There are two key types of data within the platform:; 1) patient data collected via PROMS/PREMS - this can downloaded in report format as PDFs, or extracted via RESTful APIs using FHIR.; 2) clinical/patient resources, e.g. guidelines, patient information, protocols, etc. These are available in PDF and HTML formats.
• Data export formats:
  • CSV
  • Other
• Other data export formats: FHIR-based
• Data import formats: Other
• Other data import formats: FHIR-based

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

• Guaranteed availability: Our application is hosted on Microsoft Azure and is designed to provide high availability using Azure’s resilient infrastructure. Availability targets are aligned with the underlying Azure services we consume, which typically offer service level agreements (SLAs) of 99.9% or higher, depending on the specific service and deployment configuration. Where an Azure SLA applies and availability falls below the guaranteed threshold in a given billing period, service credits are issued by Microsoft in accordance with the applicable Azure SLA. Any refunds or credits are calculated based on the affected service and downtime experienced, and are applied as service credits rather than direct financial reimbursement. Credits are provided back to the client in the form of additional support, development or reduction in following year licensing.
• Approach to resilience: Quris is hosted on Microsoft Azure and uses Availability Zones for intra‑regional fault isolation and Azure multi‑region capabilities (including paired regions) for disaster recovery. This design aligns with the NCSC’s Cloud Security Principle 2 on asset protection and resilience. Detailed datacentre topology and region specifics are available on request.
• Outage reporting: Yes, automated email alerts are provided directly to our internal support team and the client using Azure Insights.

Identity and authentication

• User authentication needed: No
• Access restrictions in management interfaces and support channels: Administrative access to Quris is restricted through Microsoft Entra ID, enforcing strong authentication, role‑based access control, and conditional access policies. Only authorised administrative users can access management interfaces, and permissions are limited to the minimum required for their role. Support channels are similarly restricted: only verified, approved Tactuum support staff can access relevant environments, and all access is logged, monitored, and time‑limited. Sensitive actions require elevated‑access workflows, and all administrative activity is subject to audit and continuous monitoring to ensure secure and controlled access at all times.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: Between 1 month and 6 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: Between 6 months and 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: Tactuum Ltd operates an Information Security Management System (ISMS) certified to ISO 27001, and all information‑security policies are maintained, reviewed and approved within this framework. Our core policies include (but are not limited to) information‑security governance, access control, secure development, incident management, business continuity, supplier management and data‑protection compliance.; ; Reporting structure:; Information security is overseen by our Senior Leadership Team and managed day‑to‑day by our Information Security Manager, who is responsible for policy maintenance, risk assessment, internal audit coordination and incident oversight. Risks and policy updates are escalated through our established governance meetings and formally reviewed at least annually.; ; Ensuring policies are followed:; Compliance is enforced through mandatory staff training, regular internal audits, continuous risk assessment, and documented change‑management and incident‑response processes. Policy adherence is monitored as part of our ISO 27001 surveillance and recertification audits, ensuring that controls remain effective and that any non‑conformities are identified and remediated promptly.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Quris follows Tactuum’s ISO 27001‑aligned configuration and change‑management processes. All Azure components are tracked through their lifecycle using version‑controlled Infrastructure as Code, mandatory tagging, and updates to our configuration management database. Changes follow a formal workflow where they are logged, reviewed, tested, and approved before deployment through gated CI/CD pipelines. Security impact is assessed through risk evaluation, peer review, automated code and dependency scanning, and change categorisation. Production changes include rollback plans and post‑implementation reviews. Continuous monitoring, internal audits, and ISO 27001 surveillance ensure policies are followed and that all changes maintain security, traceability, and operational integrity.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Quris operates a structured vulnerability‑management process aligned with Tactuum’s ISO 27001 ISMS. Potential threats are identified through regular risk assessments, automated vulnerability scanning of application code, containers, and Azure resources, and periodic penetration testing. Vulnerabilities are triaged based on severity, exploitability, and potential impact on patient safety and service availability. Critical and high‑risk patches are deployed as a priority, typically within defined SLAs, with fixes promoted through controlled CI/CD pipelines. Threat intelligence is sourced from platform vendors (Microsoft Azure), security advisories (e.g. CVEs), automated tooling, and industry best‑practice guidance, ensuring timely identification and remediation of emerging risks.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: Quris uses continuous protective monitoring to detect abnormal activity across our Azure environments, applications, and infrastructure. Potential compromises are identified through automated alerting from Azure Monitor, Defender for Cloud, centralised log analysis, anomaly detection, and correlation of security events within our SIEM. When a potential compromise is detected, we follow our ISO 27001‑aligned incident‑response procedure: initial triage, containment, investigation, eradication, and recovery, with escalation to senior staff where required. Incident response begins immediately for high‑severity alerts, with targets to assess and contain critical events within defined SLAs. All incidents undergo post‑incident review to strengthen controls and prevent recurrence.
• Incident management type: Supplier-defined controls
• Incident management approach: We operate a structured, ISO 27001‑aligned incident‑management process with pre‑defined procedures for common events, including security alerts, service degradation, data‑handling issues, and access‑related incidents. Users can report incidents through our dedicated service desk, support portal, or designated email channel, where each report is logged, triaged, and assigned a severity level. High‑impact incidents follow an accelerated escalation path to technical and security leads. We provide formal incident reports to affected customers, outlining the incident timeline, root cause, actions taken, and recommended mitigations. All incidents undergo post‑incident review to ensure continuous improvement and strengthen future resilience.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: Yes
• Connected networks:
  • Scottish Wide Area Network (SWAN)
  • Health and Social Care Network (HSCN)

Pricing

• Discount for educational organisations: No
• Free trial available: Yes
• Description of free trial: 3 month free trial with limited features restricting use to the clinical/patient resources components of the platform.

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 2%
• Between £1,000,001 and £2,500,000: 4%
• Between £2,500,001 and £5,000,000: 5%
• Over £5,000,001: 5%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: Citation ISO Certification Ltd
• ISO/IEC 27001 accreditation date: Friday 14 March 2025
• What the ISO/IEC 27001 doesn’t cover: None. Scope of certifications covers all parts of the service.
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: No
• Cyber Essentials Alternative: None of the criteria
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: 116a0223-9369-4951-aa65-59f8eb60077d
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
    • Understanding barriers to access to health and social care services or employment opportunities e.g. digital inclusion
    • Inclusive and accessible recruitment practices, development practices and retention policies that support-focused activities including those provided in the Guide for line managers on recruiting, managing and developing which support people with a disability or health condition
    • Actions to invest in the physical and mental health and wellbeing of the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at mbuchner@tactuum.com. Tell them what format you need. It will help if you say what assistive technology you use.