CEMPLICITY UK LIMITED

Cemplicity Patient Experience Insight Service

The Cemplicityy Patient Experience Insight Service enables NHS organisations to capture and act on patient experience feedback across services and pathways. Using digital patient-reported experience measures (PREMs), the service provides real-time insight, alerts and reporting to support quality improvement, governance, regulatory requirements and better patient-centred care.

Features

• Digital capture of patient experience feedback using PREMs
• Multi-channel data collection via SMS, email and QR codes
• Real-time reporting with role-based dashboards
• Automated alerts for positive and concerning patient feedback
• Workflow and case management tools for managing feedback
• Integration with patient administration and EHR systems
• Configurable surveys, triggers and reporting by service
• Secure, web-based access without local installation
• Support for Friends and Family Test reporting
• Thematic and sentiment analysis of free-text comments

Benefits

• Capture patient experience feedback digitally without increasing administrative workload
• Identify experience issues early using real-time alerts and dashboards
• Prioritise improvement actions using structured workflows and case management
• Reduce manual reporting through automated aggregation and role-based dashboards
• Support frontline teams to respond quickly to patient feedback
• Monitor service performance consistently across pathways, sites and populations
• Meet regulatory and governance requirements with auditable patient experience data
• Improve equity by identifying variation across demographic and service groups
• Enable managers to track improvement actions and outcomes over time
• Provide reliable insight to inform service redesign and quality improvement

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at hello@cemplicity.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

264305877860057

Contact

Cemplicity UK
07572989210
hello@cemplicity.com

About the service

• Service categories:
  • Application Development and Deployment
    • Analytics and business intelligence
      • Business Intelligence
        • Business Intelligence
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: The service is delivered as a secure, cloud-hosted SaaS solution and requires internet access.; ; Planned maintenance and platform updates are scheduled outside UK core working hours where possible.; ; Temporary service unavailability may occur during planned maintenance or essential security updates.; ; The service is accessed via modern web browsers and does not support unsupported or obsolete browsers.; ; Integration with patient administration or EHR systems depends on the availability of suitable data extracts or interfaces from the buyer.
• System requirements:
  • Internet-connected device with modern, supported web browser
  • Secure network connectivity to access cloud-hosted service
  • Ability to receive emails or SMS messages for notifications
  • Buyer-managed user accounts and role-based access controls
  • Supported operating systems for standard web browsers
  • Access to patient administration or EHR data extracts
  • Secure file transfer or API capability for system integration
  • Compliance with NHS information governance and security policies
  • No local software installation or specialist hardware required

User support

• Email or online ticketing support: Yes
• Support response times: Support requests are acknowledged within one UK business day during standard working hours.; Standard support operates Monday to Friday, UK business hours, excluding public holidays.; Response times may be longer at weekends and public holidays, unless otherwise agreed for critical incidents.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: None or don’t know
• Phone support: No
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: The service includes standard support as part of the annual subscription at no additional cost. Standard support provides access to the support desk for service questions, configuration guidance, incident reporting and general assistance. Support is available during UK business hours, Monday to Friday, excluding public holidays.; ; Support requests are logged through an online ticketing system and triaged according to impact and urgency. Critical service issues are prioritised and managed in line with agreed service levels.; ; Enhanced support options are available by agreement and may include extended support hours, priority response times, additional reporting, or bespoke operational support. The cost of enhanced support depends on the scope and duration of the services required and is agreed contractually in advance.; ; Each buyer is assigned a dedicated account manager, who acts as the primary point of contact for service delivery, onboarding, and ongoing service optimisation. The account manager works alongside technical specialists and support engineers as required. A named technical account manager or cloud support engineer can be provided as part of enhanced support arrangements.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: We support users to start using the service through a structured onboarding process. This includes implementation planning, service configuration and guided setup aligned to the buyer’s requirements. Users are provided with online training sessions, user documentation and support materials tailored to their roles.; ; Training is typically delivered remotely, with optional onsite training available by agreement. Ongoing support is provided through a dedicated account manager and online support desk to help users adopt the service effectively.
• Service documentation: Yes
• Documentation formats: HTML
• Documentation accessibility standard: WCAG 2.2 AA
• End-of-contract data extraction: At the end of the contract, users can request a secure extract of their data. Data is provided in commonly used, machine-readable formats such as CSV or JSON, containing patient-reported responses and associated metadata. Data extracts are transferred securely using agreed methods. Following confirmation of successful data transfer, data is retained or securely deleted in line with contractual and information governance requirements.
• End-of-contract process: At the end of the contract, buyers can request a secure extract of their data in an agreed, machine-readable format. Following confirmation that data has been successfully transferred, the service is decommissioned and buyer data is retained or securely deleted in line with contractual terms and information governance requirements.; ; The contract price includes access to the service for the agreed term, standard support, hosting, routine maintenance, security updates, and ongoing platform enhancements. It also includes support for standard onboarding, service configuration, and access to reporting and dashboards.; ; Additional costs may apply for optional services requested outside the standard scope. These can include bespoke integrations, enhanced support arrangements, additional training, specialist analysis, or non-standard data extraction or reporting requirements. Any additional costs are agreed in advance with the buyer.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: The service is accessed through a responsive, web-based interface that adapts to mobile and desktop devices. Core functionality, data access and security controls are the same across both. On smaller screens, layouts are optimised for readability and navigation, and some advanced reporting views may be easier to use on desktop devices.
• Service interface: Yes
• Description of service interface: Yes. The service is accessed through a secure, web-based user interface. Users access dashboards, reports, alerts and workflow tools via a standard web browser, with no local software installation required. The interface is role-based and responsive, supporting access on desktop and mobile devices.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: Accessibility is considered throughout the design and development of the service interface. Testing includes internal usability testing using keyboard-only navigation and screen reader tools to assess navigation, form interaction and content clarity. Accessibility checks are carried out as part of ongoing development and platform updates, and feedback from users is used to inform improvements where accessibility issues are identified.
• User support accessibility: WCAG 2.2 AA
• API: Yes
• What users can and can't do using the API: The service includes a private, supplier-managed API used to support system integrations and data exchange with patient administration and electronic health record systems.; ; The API is not designed for direct use by NHS users and does not provide self-service configuration or management capabilities. Initial service setup, configuration and ongoing changes are managed by Cemplicity in collaboration with the buyer, using agreed implementation and change processes.; ; Through an API, authorised integrations could securely exchange patient and contextual data to support survey invitations and reporting; ; Users cannot use the API to:; ; 1. Independently set up new services or surveys; ; 2. Modify workflows, alerts or reporting configurations; ; 3. Access or manage the service interface; ; API access is restricted, authenticated and provided only where technically appropriate. Any changes to integrations or data flows are assessed and implemented by Cemplicity to ensure security, data integrity and compliance with NHS information governance requirements.
• API documentation: Yes
• API documentation formats: Open API (also known as Swagger)
• API sandbox or test environment: No
• Customisation available: Yes
• Description of customisation: Yes. Buyers can customise the service during implementation, including the selection and configuration of patient-reported survey tools, question sets, delivery modes and reporting views. The service supports the use of validated national instruments as well as locally defined surveys.; ; Once a service is live, customisation is limited to protect data quality, comparability and service stability. Changes to surveys, logic or reporting are managed through agreed change processes and are assessed for impact before implementation.

Scaling

• Independence of resources: The service is delivered using a scalable, cloud-hosted architecture designed to support multiple organisations concurrently. Resources are logically separated by organisation, and capacity is monitored continuously to ensure consistent performance. The platform uses automated scaling and operational monitoring to manage demand, reducing the risk that activity from one customer impacts others.

Analytics

• Service usage metrics: Yes
• Metrics types: The service provides a comprehensive set of metrics to support operational monitoring, quality improvement and service adoption. Core analytics focus on patient-reported experience data, including response rates, scores, trends over time and variation by service, pathway, location and demographic groups.; ; Authorised users can access respondent-level views where appropriate, enabling frontline teams to review individual responses, free-text comments and associated alerts to support timely follow-up and action. Aggregated and anonymised views are available for governance, benchmarking and management reporting.; ; Service metrics are presented through role-based dashboards and reports, supporting transparency, accountability and continuous improvement across organisations and systems.
• Reporting types: Real-time dashboards
• Resource tagging: No
• FOCUS resource tagging: No

Supplier type

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: None

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest: Physical access control, complying with SSAE-18 / ISAE 3402
• Data sanitisation process: Yes
• Data sanitisation type: Deleted data can’t be directly accessed / Cryptographic Erasure
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

• Data export approach: Users can request secure exports of their data from the service. Data is provided in commonly used, machine-readable formats such as CSV or JSON and includes survey responses and associated metadata. Exports are transferred using secure, agreed methods in line with information governance requirements.
• Data export formats: CSV
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • Other
• Other protection within supplier network: Data within the service network is protected using layered security controls. Access to systems and data is restricted using role-based access controls and the principle of least privilege. Data is encrypted at rest using industry-standard encryption. Network segmentation, firewalls and continuous monitoring are used to protect internal data flows and detect unauthorised activity.

Availability and resilience

• Guaranteed availability: The service is designed for high availability using a resilient, cloud-hosted architecture. We target 99.5% service availability measured monthly, excluding planned maintenance.; ; Planned maintenance is scheduled outside UK core working hours wherever possible and notified to users in advance. Temporary service interruptions may occur during essential maintenance or security updates.; ; Where availability falls below the guaranteed level due to a service-related issue, buyers may be eligible for service credits. Service credits are applied as a proportionate reduction against future subscription fees and are calculated based on the duration and impact of the outage. Service credits are the buyer’s sole remedy for failure to meet availability targets.; ; Full details of availability measurement, exclusions and service credit calculations are set out in the contract.
• Approach to resilience: The service is delivered using a resilient, cloud-hosted architecture designed to maintain availability and protect customer data. It is hosted on Amazon Web Services (AWS) within the UK to reduce the risk of single points of failure.; ; Core platform components are monitored continuously, with automated alerts and operational procedures in place to detect and respond to incidents. Data is regularly backed up and protected using industry-standard security and recovery controls.; ; The underlying data centre infrastructure, physical security, power, cooling and network resilience are managed by AWS in line with recognised international standards. Further details of the technical architecture and resilience controls can be provided to buyers on request.
• Outage reporting: Service outages and significant incidents are communicated directly to buyers. There is no public status dashboard or public API for outage reporting. Buyers are notified of service issues and planned maintenance via email through agreed operational contacts. Updates are provided until the issue is resolved.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password
• Access restrictions in management interfaces and support channels: Access is restricted using role-based access controls and the principle of least privilege. User access is granted only to authorised individuals based on job role and responsibilities.; ; Authentication controls are enforced for all administrative and support access, with access reviewed regularly. Management interfaces are accessible only over secure connections, and activity is logged and monitored to support audit and incident investigation.; ; Support channels, including the support ticketing system, restrict access to authorised buyer contacts and supplier staff. Access is removed promptly when staff leave or change roles, ensuring continued protection of customer data and service operations.
• Access restriction testing frequency: At least once a year
• Management access authentication: Multi-Factor Authentication (MFA)

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: Between 6 months and 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: Between 6 months and 12 months
• How long system logs are stored for: Between 1 month and 6 months

Security governance

• Named board-level person responsible for service security: Yes
• Software Security Code of Practice: Yes
• Security governance certified: Yes
• Security governance standards:
  • CSA CSM version 4.0
  • ISO/IEC 27001
• Information security policies and processes: Information security is managed through a formal set of policies and processes aligned to ISO/IEC 27001 principles and the NHS Digital Technology Assessment Criteria (DTAC). These policies cover areas including access control, data protection, incident management, risk assessment, supplier assurance and business continuity.; ; Responsibility for information security sits with senior management, with defined ownership for policy approval, implementation and ongoing review. Operational responsibility is delegated to designated security and engineering leads, who ensure controls are implemented consistently across the service.; ; Policies are embedded into day-to-day operations through staff training, role-based access controls, secure development practices and regular internal reviews. Compliance is monitored through documented processes, risk assessments, audits and incident reporting. Where required, evidence is made available to buyers to support DTAC assurance and NHS information governance requirements.

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Our approach is governed by defined processes aligned with ISO 27001 principles and NHS DTAC requirements. Programmes are documented and tracked through their lifecycle using versioning and change records.; ; All changes are planned, reviewed and tested before deployment. Changes are assessed for potential security impact as part of the change process, including review of data protection, access controls and service availability. Higher-risk changes are subject to additional review and approval.; ; Changes are restricted to authorised personnel and deployed using controlled release processes. Outcomes are monitored to identify unintended impact. Rollback procedures are in place to restore service if issues identified.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Vulnerability management is aligned with ISO/IEC 27001 principles and NHS DTAC requirements. Potential threats are assessed through risk reviews, monitoring of the service environment and secure development practices.; ; Threat information is obtained from cloud provider advisories, software vendors, industry vulnerability databases and internal monitoring. Security patches are prioritised by severity, tested and deployed promptly using controlled release processes, with critical patches applied as soon as practicable.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: Protective monitoring uses supplier-defined controls aligned with ISO/IEC 27001 and NHS DTAC. Potential compromises are identified through system monitoring, logging and automated alerts.; ; Alerts are investigated by authorised staff and managed using documented incident procedures. Critical incidents are responded to immediately during UK business hours, with out-of-hours response for high-impact issues. Buyers are notified of confirmed security incidents where required.
• Incident management type: Supplier-defined controls
• Post-quantum cryptography secure: No
• Incident management approach: Incident management follows defined, supplier-controlled processes aligned with ISO/IEC 27001 principles and NHS DTAC requirements. Pre-defined procedures are in place for common incident types, including service outages, security incidents and data-related issues.; ; Users report incidents through the online support ticketing system or by contacting their designated support contacts. Incidents are logged, prioritised and managed based on impact and urgency, with escalation to technical and senior staff where required.; ; For significant incidents, users are kept informed through direct communications. Incident reports can be provided following resolution, including a summary of the issue, actions taken and any preventive measures implemented.

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 0%
• Between £2,500,001 and £5,000,000: 0%
• Over £5,000,001: 0%

Standards and certifications

• ISO/IEC 27001 certification: Yes
• ISO/IEC 27001 accredited by: LRQA (Lloyd's Register Quality Assurance Limited)
• ISO/IEC 27001 accreditation date: Sunday 7 December 2025
• What the ISO/IEC 27001 doesn’t cover: ISO/IEC 27001 certification applies to the information security management system (ISMS) covering the operation and delivery of the service. The certification does not extend to buyer-managed systems, third-party systems not under our control, or the internal processes and environments of customer organisations. End-user devices, local networks and downstream use of exported data are also outside the scope of certification.
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber Essentials Certificate Number: 28c96a90-393f-4930-ab99-a73b4f5ec0c1
• Cyber essentials plus: No
• Cyber Essentials Alternative: In relation to the services you do not have a current and valid Cyber Essentials Plus certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials Plus certificate by one of the government approved accreditation bodies within 12 months of the date of award.
• Other security certifications: No

Social value

• Mission: Build an NHS fit for the future:

  That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

  Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

  • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
  • Understanding barriers to access to health and social care services or employment opportunities e.g. digital inclusion
  • Inclusive and accessible recruitment practices, development practices and retention policies that support-focused activities including those provided in the Guide for line managers on recruiting, managing and developing which support people with a disability or health condition
  • Actions to invest in the physical and mental health and wellbeing of the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at hello@cemplicity.com. Tell them what format you need. It will help if you say what assistive technology you use.