Skip to main content

Beta Help us improve the Digital Marketplace - send your feedback

Orchid Live

Orchid Live

Specialist occupational health software for case management, pre-placement health checks, health surveillance and recalls, diary management for occupational health teams and analysis of workforce health issues.

Features

  • Case management
  • Health surveillance & recalls
  • Pre-placement assessments
  • OH team diary management
  • Role based access to clinical data
  • Cloud based platform
  • Long term storage of clinical data
  • Detailed audit trail of all actions
  • SSO & Multi-Factor Authentication
  • Fully customisable

Benefits

  • Easy generation of clinical reports
  • Simple report of upcoming health surveillance
  • Efficient OH team workflows
  • Access the software from any device and location
  • Complete oversight of user permissions and access to clinical records
  • "Smart" questionnaires to save clinicians time
  • SMS appointment reminders to reduce DNAs

Pricing

£24,000 to £24,000 an instance a year

Service documents

Request an accessible format
If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at oliver@orchidlive.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 14

Service ID

2 5 4 3 2 1 2 7 9 1 1 4 0 8 8

Contact

Orchid Live Oliver Bridge
Telephone: 0191 500 9746
Email: oliver@orchidlive.com

Service scope

Software add-on or extension
No
Cloud deployment model
Private cloud
Service constraints
Orchid Live is only available as cloud based software, so an internet connection is required to use it.
System requirements
  • An internet connection
  • Moden browser - Chrome, Firefox, Edge, Safari, Opera

User support

Email or online ticketing support
Email or online ticketing
Support response times
Within 2 working days for 'normal priority' issues or same working day if a critical issue.
User can manage status and priority of support tickets
No
Phone support
Yes
Phone support availability
9 to 5 (UK time), Monday to Friday
Web chat support
No
Onsite support
Onsite support
Support levels
Support is included as part of the licence fee.

Users report issues via telephone, the 'help' button within the software or via email, and this creates a ticket in our internal help desk.

Depending on the nature of the issue, the appropriate staff member internally is assigned to contact the user and resolve it for them.
Support available to third parties
Yes

Onboarding and offboarding

Getting started
As part of implementation, live training is provided to introduce clients to the software, and this is recorded so that it can be distributed throughout the organisation and used for new joiners in future.

Top-up / ad hoc training is available if needed.

An online manual is also available for reference at any time.
Service documentation
Yes
Documentation formats
PDF
End-of-contract data extraction
Users can export data themselves or we can export it in a format of their choosing.
End-of-contract process
When the contract ends, access to the software will be stopped for all users. Since it is cloud based, no un-installing if required.

Custom data exports are chargeable at our development day rate.

Using the service

Web browser interface
Yes
Supported browsers
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
Application to install
No
Designed for use on mobile devices
Yes
Differences between the mobile and desktop service
Orchid Live is best used on a desktop or tablet.

Whilst it is possible to use it on a mobile phone, in practice, the menu and data presentation structure etc doesn't lend itself to a small narrow screen, and so it is not an optimal experience.
Service interface
Yes
User support accessibility
None or don’t know
Description of service interface
We have an API
Accessibility standards
None or don’t know
Description of accessibility
The application is fully accessible via browser for users.
Accessibility testing
None.
API
Yes
What users can and can't do using the API
2-way API
Changes are mainly related to employee personnel details, although we have an interface to a lab results application too.
API documentation
Yes
API documentation formats
HTML
API sandbox or test environment
Yes
Customisation available
Yes
Description of customisation
Clients can customise a large amount of content within the software such as the templates used to generate reports, the options that clinicians / managers are able to select when submitting referrals or assessing a patient, and the configuration of team diaries.

Everything else in the software - workflows, branding, security parameters etc can be customised to user requirements, but requires custom development work by our team.

Scaling

Independence of resources
Each client has their own hardware with auto-scaling enabled to meet periods of higher demand.

Analytics

Service usage metrics
Yes
Metrics types
A dashboard shows the number of open cases, health surveillance recalls upcoming etc.

Reports covering any aspect of user data can be downloaded by the user in CSV format. There are 200 standard reports in the software and these can be added to or edited as required.
Reporting types
  • Real-time dashboards
  • Reports on request

Resellers

Supplier type
Not a reseller

Staff security

Staff security clearance
Other security clearance
Government security clearance
None

Asset protection

Knowledge of data storage and processing locations
Yes
Data storage and processing locations
United Kingdom
User control over data storage and processing locations
No
Datacentre security standards
Complies with a recognised standard (for example CSA CCM version 3.0)
Penetration testing frequency
At least once a year
Penetration testing approach
‘IT Health Check’ performed by a Tigerscheme qualified provider or a CREST-approved service provider
Protecting data at rest
Physical access control, complying with another standard
Data sanitisation process
Yes
Data sanitisation type
Explicit overwriting of storage before reallocation
Equipment disposal approach
Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

Data export approach
A complete record per employee can be exported with no interaction required from our support team.

A complete export of the data or of individual contracts can be requested at any point.
Data export formats
  • CSV
  • Other
Other data export formats
As per original document format (DocX, XLS, PDF etc)
Data import formats
  • CSV
  • Other
Other data import formats
Original document format (PDF, DocX, XLS etc)

Data-in-transit protection

Data protection between buyer and supplier networks
  • Private network or public sector network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
Data protection within supplier network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway

Availability and resilience

Guaranteed availability
99.9% uptime.

Repeated breach of uptime SLA entitles clients to cancel their contract.
Approach to resilience
Our software runs in 3x AWS availability zones, providing seamless transition without user disruption should there be an issue in one of the data centres.
Outage reporting
We would email clients if there was an outage as per our DR plan

Identity and authentication

User authentication needed
Yes
User authentication
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
Access restrictions in management interfaces and support channels
All users of the system have a role assigned to them with particular permissions, meaning they only have access to certain parts of the software and certain functionality.
Access restriction testing frequency
At least once a year
Management access authentication
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password

Audit information for users

Access to user activity audit information
Users have access to real-time audit information
How long user audit data is stored for
At least 12 months
Access to supplier activity audit information
You control when users can access audit information
How long supplier audit data is stored for
At least 12 months
How long system logs are stored for
At least 12 months

Standards and certifications

ISO/IEC 27001 certification
Yes
Who accredited the ISO/IEC 27001
British Assessment Bureau
ISO/IEC 27001 accreditation date
1/2/2024
What the ISO/IEC 27001 doesn’t cover
Our whole service is covered.
ISO 28000:2007 certification
No
CSA STAR certification
No
PCI certification
No
Cyber essentials
Yes
Cyber essentials plus
No
Other security certifications
No

Security governance

Named board-level person responsible for service security
Yes
Security governance certified
Yes
Security governance standards
ISO/IEC 27001
Information security policies and processes
Full compliance with ISO270001 internally, with regular management reviews to ensure any organisational or software changes are incorporated into our information security policy.

Operational security

Configuration and change management standard
Supplier-defined controls
Configuration and change management approach
* Every code release is tested before deployment and peer reviewed
* Changes are version controlled and logged, and can be reverted if required
Vulnerability management type
Supplier-defined controls
Vulnerability management approach
* Annual penetration test conducted by CREST accredited partner
* Cyber Essentials certified
Protective monitoring type
Supplier-defined controls
Protective monitoring approach
* Vulnerability scans on all code during deployment
* Builds fail if a vulnerability is found
* If any existing code is found to have a vulnerability it would either be reverted or immediately patched where possible
Incident management type
Supplier-defined controls
Incident management approach
* Users can report incidents via help desk, telephone or email
* AWS cloud watch alerts us to any infrastructure issues
* SLA in place for us to respond to serious issues
* Full report provided for serious issues

Secure development

Approach to secure software development best practice
Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v3.0)

Public sector networks

Connection to public sector networks
No

Social Value

Social Value

Social Value

  • Tackling economic inequality
  • Equal opportunity
  • Wellbeing

Tackling economic inequality

We regularly sponsor apprentices and believe this is a great way to develop new skills.

Equal opportunity

We have a robust equal opportunity policy in place in respect of recruitment and treatment of team members in the workplace.

Wellbeing

Our staff have the option of a 4 day working week to help with work/life balance.

Pricing

Price
£24,000 to £24,000 an instance a year
Discount for educational organisations
No
Free trial available
Yes
Description of free trial
You can test a full version of the software with up to 9 users at no cost.
Link to free trial
https://orchidlive.com/public/

Service documents

Request an accessible format
If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at oliver@orchidlive.com. Tell them what format you need. It will help if you say what assistive technology you use.