IMOSPHERE LTD

Connected Toolkit and Formulate for Continuing Healthcare & Continuing Care

Giving Integrated Care Boards visibility and control of their CHC and CC spending through fair, consistent and needs-led distribution of funding - including for notional and direct payment Personal Health Budgets.

Features

• Cloud-based software platform to complete forms/calculations
• Real-time indicative PHB calculations for children (CC) and adults (CHC)
• Clear and concise form questions to drive the calculation
• Allocation Summary output accompanying estimated budget (breakdown by health/care domain)
• Quality Assurance output to help ensure accuracy of data
• Self-service analytics dashboards and data export facility for additional analysis
• Full data audit of every form and every calculation
• Remote updates to algorithm configuration as things change
• Specialist support with configuration and implementation

Benefits

• Digitise PHB workflows to replace existing fragmented systems
• Gain control of CHC/CC spending through unparalleled accuracy levels
• Use an all-age approach (similar tools for CC and CHC)
• Reduce inequity (allocate similar funding for individuals with similar needs)
• Comply with national indicative budget requirements (PHB Quality Framework 2023)
• Avoid ‘reinventing the wheel’ (tried and tested solution)
• Be equipped for different situations (covers all levels of need)
• Align with the government’s Algorithmic Transparency Recording Standard
• Measure change in need over time and forecast future need

• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at info@imosphere.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

275004311950549

Contact

Oliver Brown
0800 802 1884
info@imosphere.co.uk

About your service

• Service categories:

  Applications

  Production and operations

  Service industry and public sector operations

  • Healthcare
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: There is a brief monthly maintenance window which is timed to be outside of UK core office hours.
• System requirements:
  • Web-based access; no local installation required
  • Modern web browser with JavaScript and cookies enabled
  • Reliable internet connection over HTTPS
  • Role-based user accounts managed by the ICB
  • Software to open/view DOCX and PDF export files
  • Email access for account invitations and notifications

User support

• Email or online ticketing support: Yes
• Support response times: Core support hours: Mon–Fri 09:00–17:30 UK time (excluding bank holidays). Response targets: Priority 1 (service unavailable) notify key contacts within 1 hour of awareness, restore within 24 hours, permanent fix within 5 working days. Priority 2 initial response within 4 support hours; workaround within 2 working days; permanent fix within 7 working days. Priority 3 initial response within 1 working day; cause within 10 working days; action within 15 working days. Priority 4 initial response within 3 working days. Out of hours/weekends: tickets are logged and triaged next business day; Priority 1 incidents are escalated immediately.
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: No
• Support levels: We provide a service desk ticket system and email support 09:00–17:30 UK time, Monday–Friday, excluding bank holidays. SLA targets: P1 service outage notify key contacts within 1 hour, restore within 24 hours; P2 initial response 4 support hours; P3 1 working day; P4 3 working days. Weekend/out‑of‑hours tickets are logged and triaged next business day; P1 incidents are escalated immediately.; ; This does not come at an extra cost but is included in the annual contract fees - which also includes regular software updates, remote check‑ins with customer success team, online training resources and attendance at customer events.; ; Any extended hours cover required by customers and any training/workshops or configuration/modelling assistance not included in the annual contract fee are priced at our published G‑Cloud day rates ; ; A named Project Manager and Customer Success Consultant is provided during implementation, with the named Customer Success Consultant continuing for BAU for the lifetime of the contract.
• Support available to third parties: No

Onboarding and offboarding

• Getting started: Our primary software onboarding approach is through online training videos. We provide a range of customer-facing documentation to support different aspects of the implementation, such as the process of determining the unit costs (rates) applied to 'units of care/support' calculated by the algorithm(s).
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: A self-service data extract feature is available in the Connected Toolkit software to 'Elevated Users' (within ICBs) - enabling all data from completed forms and associated calculation results to be downloaded in CSV format.
• End-of-contract process: Having agreed the end point of the contract, allowing time for export of the data required, we would disable all access to the software and securely destroy data held on our systems in line with our data sanitisation processes - with the exception of any data to be retained as per our Data Retention Policy. We retain financial information regarding our relationship for the period required by HMRC.; The above is all included in the price of the contract.; Additional data export services and migration consultancy may be available on request - and at an additional cost.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Chrome
• Application to install: No
• Designed for use on mobile devices: No
• Service interface: Yes
• User support accessibility: WCAG 2.2 AA
• Description of service interface: Browser-based user interface. Users log in to the Connected Toolkit software to complete 'Needs Profiles' and calculate estimated budgets for CHC/CC funding via the Formulate algorithm(s). They also export DOCX/PDF reports, submit Actual Budget figures, and, where privileges allow, access manager dashboards. No local installation. Accessed over HTTPS. Data stored in the UK.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: Not yet completed
• API: No
• Customisation available: Yes
• Description of customisation: The following can be customised in the system:; ; (1) The unit costs (rates) applied to 'units of care/support' calculated by the 'Formulate' algorithm(s). This is facilitated by the ICB completing a local ‘Formulate Configuration template’ for CHC (and for CC if this is also purchased). The configuration template(s) are the key deliverable(s) for the ICB - setting out each step of the algorithm’s allocation process and explaining the options available for configuring to reflect local circumstances and costs. This process and the expertise we offer in supporting it are essential in ensuring fair, sufficient and financially sustainable personal health budgets – and providing a clear record of all decisions. Once the document has been completed (involving senior representatives from finance, commissioning and front-line practice), the decisions are applied by Imosphere to the algorithm.; ; (2) Deciding whether the data entered into the system is associated to the organisation (ICB) as a whole or divided up by locally-defined 'Service Areas' (e.g. localities) for viewing and reporting purposes.; ; (3) Key terms which appear within the Connected Toolkit software can be locally overridden with alternative terms (e.g. the term for 'service user' or 'patient').

Scaling

• Independence of resources: The Connected Toolkit software is multi-tenant with logical isolation per ICB. Formulate calculations run on auto-scaled stateless API workers; operations are predominantly read-heavy, so database locking is rare.

Analytics

• Service usage metrics: Yes
• Metrics types: Nominated ICB representatives are provided with access to 'Data Explorer' within our Formulate Portal cloud-based platform. This includes:; ; - Insights: A set of pre-designed 'dashboards' showing key statistics about the organisation's use of the system with customisable time periods, for example numbers of calculation per user and forms with large numbers of calculations.; ; - Extracts: Enables them to generate their own CSV exports of the input and output data involved in their estimated budget calculations via Formulate. This will show numbers of cases submitted through the system together with dates and times.
• Reporting types: Real-time dashboards
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Physical access control, complying with another standard
  • Encryption of all physical media
  • Scale, obfuscating techniques, or data storage sharding
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type: Data Erasure

Data importing and exporting

• Data export approach: Data exports of the input and output data involved in calculations made within the Connected Toolkit software via the Formulate for CHC and/or CC algorithms can be exported in CSV format.; Users can also export individual forms (including or excluding calculation results) in PDF format.
• Data export formats:
  • CSV
  • Other
• Other data export formats: PDF
• Data import formats: Other
• Other data import formats: N/A

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • Private network or public sector network
  • TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: We guarantee 99.99% application availability, measured on a monthly basis, excluding planned maintenance and force majeure events. The service is hosted on resilient infrastructure with continuous monitoring. Availability is tracked at application level and reviewed monthly. If monthly availability falls below the guaranteed level, customers are entitled to a service credit equivalent to one day’s service for each full day in which the availability guarantee is breached, calculated on a pro-rata basis. Service credits are applied as a credit against future invoices or as additional service time at no charge, at our discretion. To request a service credit, customers must notify us within the relevant billing period, providing details of the dates of the service breach. All requests are validated against our service availability monitoring data.; The total service credit applied in any month will not exceed 100% of the monthly service charge for the affected service.
• Approach to resilience: Information is available on request.
• Outage reporting: Outage reports and notifications of planned work that may affect services are available via a public dashboard. Detailed information, including where individual customers may be affected, is provided via email alerts.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password
• Access restrictions in management interfaces and support channels: Only users assigned 'Management' or 'Administrator' permissions can access management interfaces - and these levels are reserved solely for Imosphere employees.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: We operate an Information Security Management System (ISMS) certified to ISO 27001:2022, supported by a comprehensive suite of policies covering areas such as employee screening and training, record classification and retention, information risk management, change management, incident management, business continuity, supplier management, network and access control, cryptographic controls, pseudonymisation and de-identification, and physical security.; Information security is overseen by our COO, who also serves as Chief Information Security Officer (CISO) and reports directly to the CEO. We also have a named Data Protection Officer. Day-to-day operation of technical and organisational controls is carried out by our Information Security Officer, IT Manager and CTO, with defined escalation routes for risks, incidents and non-conformities.; We ensure policies are followed through mandatory annual training for all employees, role-specific training for privileged users, internal audits, continuous monitoring of key controls, regular access reviews, supplier assessments, and structured incident reporting that is reviewed in monthly meetings.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: We have a documented configuration and change management policy.; We track the hardware components of our solutions via an asset management database.; Our change management process includes testing and review prior to implementation.; All software changes go through our full software development lifecycle, including quality gateways, multiple forms of testing (automated, security, UAT, requirements etc) and release management processes.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: We follow a documented vulnerability management policy. Routine updates are deployed on a monthly scheduled basis following testing in a lab environment with maximum timeline of 10 working days. Emergency updates are deployed following our emergency change process with a maximum timeline of 2 working days. Multiple sources are used for information: independent security organisations (i.e. BugTraq, Full Disclosure), vendors, government (e.g. NCSC, NIST), published information from security organisations and professionals and security conferences.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: We have a documented Information security event management policy. We use a SIEM tool to monitor activity on both compute and network devices with automated rules to highlight suspicious activity.; Potential compromises are raised within our Information Security Team messaging channel, and response is agreed depending on the severity. These are logged in our IS Issues Log.
• Incident management type: Supplier-defined controls
• Incident management approach: Our incident management process is based on the ITIL approach and includes consideration of prioritisation, proportionate response, monitoring, escalation and retrospective review. All employees are trained on the incident reporting and management approach. Senior management monitor issues in aggregate and on specific escalated issues, including performance against internal and external SLA standards.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: Yes
• Description of free trial: We provide a 2-week free trial for ICBs in England. This is a fully-featured trial - governed by the rule that adding any identifying information about real individuals to the system in not permitted.

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 0%
• Between £2,500,001 and £5,000,000: 0%
• Over £5,000,001: 0%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: LRQA
• ISO/IEC 27001 accreditation date: Wednesday 22 January 2025
• What the ISO/IEC 27001 doesn’t cover: N/A
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 654ac91f-1265-4ec9-aaea-35e2f4ea8eae
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: 5491d37d-36d8-4d68-a9a4-5bf7e390de55
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Plans to engage the contract workforce in deciding the most important workplace issues to address
    • Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
    • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
    • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
    • Offer a pay and leave entitlement to all eligible staff who become kinship carers, ideally equivalent to statutory adoption pay and leave
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Monitoring and reporting of gender and ethnicity pay gaps and plans to address them where necessary
    • Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible
    • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
    • Volunteering opportunities for staff

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

    • Activities to identify opportunities to open up sub-contracts under the prime contract to a diverse range of businesses, including new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutuals
    • Measures to involve local stakeholders and/or users in design (e.g. in the design of services, systems, products or buildings)

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
    • Actions to invest in the physical and mental health and wellbeing of the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at info@imosphere.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.