MYWAY DIGITAL HEALTH LIMITED

MyWay Clinical

MyWay Clinical is a cloud-based clinical decision support platform for healthcare professionals. It uses patient data, risk stratification and analytics to support proactive care, population management and clinical prioritisation, helping teams identify risk earlier, focus resources effectively and improve outcomes across defined patient populations.

Features

• Clinical decision support using patient and population data
• Risk stratification across defined patient cohorts
• Analytics dashboards for population health management
• Clinical prioritisation based on risk and need
• Use of guideline-aligned thresholds and indicators
• Integration with existing clinical data sources
• Population reporting to support service planning
• Secure access for authorised clinical users
• Fully hosted, managed clinical SaaS platform
• Configuration aligned to local pathways and priorities

Benefits

• Enable proactive identification of patients at increased clinical risk
• Support earlier intervention across defined patient populations
• Help clinical teams prioritise care effectively
• Improve visibility of population-level risk and trends
• Support consistent decision-making across teams
• Reduce reliance on manual data analysis and reporting
• Support planning and optimisation of clinical services
• Focus clinical time on patients most likely to benefit
• Enable scalable population health management approaches
• Support improved outcomes through data-informed care

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at louise.o'mahony@mwdh.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

355515024549008

Contact

Louise O Mahony
+44 (0)7463120512
louise.o'mahony@mwdh.co.uk

About your service

• Service categories:

  Applications

  Production and operations

  Service industry and public sector operations

  • Healthcare
• Multi cloud support: Yes

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: MyWay Clinical can be used as a standalone service. It may also be used alongside other MyWay Digital Health services, such as MyWay Health or MyWay Communications, where organisations choose to integrate clinical decision support with patient-facing or engagement services.
• Cloud deployment model: Public cloud
• Service constraints: MyWay Clinical is delivered as a fully hosted, managed SaaS service and accessed via secure web-based interfaces. Planned maintenance is undertaken outside of core business hours wherever possible. Support is provided during standard business hours. Deployment is subject to local information governance approvals and data sharing agreements. Integration is supported with agreed clinical data sources; additional integrations may require separate agreement. The service supports clinical decision-making and prioritisation but does not replace professional clinical judgement.
• System requirements: Modern web browser

User support

• Email or online ticketing support: Yes
• Support response times: Immediate automated response with a 48 hour resolution
• User can manage status and priority of support tickets: No
• Phone support: No
• Web chat support: No
• Onsite support: No
• Support levels: MyWay Clinical provides a structured support model appropriate to a cloud-based clinical decision support service.; ; Standard Support is included in the service price. This provides email-based support during UK business hours for technical queries, configuration support, incident reporting, and operational assistance. Support requests are triaged by severity, with service-impacting issues prioritised.; ; There are no separate support tiers. All customers receive the same standard level of support to ensure consistent service delivery and governance.; ; Support costs are included within the contract price. There are no additional charges for standard technical support.; ; MyWay Clinical is delivered as a fully managed service. Customers are supported by a named service contact who coordinates support activity, configuration, and ongoing service delivery. This role provides continuity and acts as the primary point of contact but is not a full Technical Account Manager.; ; Technical troubleshooting and platform support are provided by the MyWay Digital Health technical team. Customers do not require direct access to a cloud support engineer.
• Support available to third parties: No

Onboarding and offboarding

• Getting started: We support users to start using the service through a structured onboarding and self-service approach.; ; New users are supported through an onboarding training session, which introduces the service, key workflows, and how to use the platform effectively.; ; All users receive welcome emails after registration, providing guidance on accessing the service and next steps.; ; We provide FAQs covering common questions and core functionality, enabling users to quickly find answers and self-serve where possible.; ; Screenshots and visual guides are provided to support onboarding and explain key features and workflows in a clear, easy-to-follow format.; ; Together, these resources ensure users can begin using the service confidently without requiring onsite training.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: At the end of the contract, users cannot extract data from the service. There is no self-service, manual, or automated data extraction capability provided.; ; The service is delivered as a fully managed SaaS platform, and data remains within the service environment for the duration of the contract only. Upon contract termination, access to the service is removed and data is retained and securely deleted in accordance with our data retention and deletion policies.
• End-of-contract process: At the end of the contract, a standard end-of-contract process is followed.; ; On contract expiry, access to the service is removed for all users and no further service delivery takes place. The service is no longer available for use after the contract end date.; ; There are no additional charges associated with the standard end-of-contract process. All costs relating to service delivery are included within the contract price for the duration of the contract.; ; Following contract termination, data is handled in accordance with contractual terms, data sharing agreements, and information governance requirements. Data is retained and securely deleted in line with defined retention policies. Users do not extract data from the service at contract end. Access for healthcare professionals is removed at contract end, and any data not required to be retained is securely deleted in line with legal and information governance requirements.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: Yes
• Compatible operating systems:
  • Android
  • IOS
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: The design has been modified to support mobile usage
• Service interface: No
• User support accessibility: WCAG 2.2 AAA
• API: No
• Customisation available: No

Scaling

• Independence of resources: The service uses a standard scalable approach to manage demand. Capacity is designed to support growth in users and usage, ensuring that demand from one group of users does not negatively impact others. The service has been designed to support scale as a core requirement.

Analytics

• Service usage metrics: Yes
• Metrics types: We provide service usage and population-level metrics to support monitoring, evaluation, and service oversight.; ; Metrics include clinician registrations and active use of the platform, cohort size, risk stratification breakdowns, and trends across defined patient populations. We also provide clinical prioritisation metrics showing numbers of patients flagged by risk level or guideline-aligned indicators.; ; Metrics are provided in aggregate form and aligned to locally agreed reporting requirements to support population health management, service planning, and quality improvement.; ; Metrics are shared with commissioners and authorised stakeholders as part of the managed service and are not available via self-service data export.
• Reporting types: Regular reports
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest: Physical access control, complying with CSA CCM v4.0
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type: Data Erasure

Data importing and exporting

• Data export approach: Data export is not supported as part of the service.
• Data export formats: Other
• Other data export formats: Data exports are not available
• Data import formats: Other
• Other data import formats: Data imports are not available for users

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: The service has a guaranteed availability of 95%.; ; This availability level acts as a contractual backstop. Actual availability typically exceeds this level, but only the guaranteed level is committed to.; ; Service level agreements (SLAs), including how availability is measured and any applicable service credits or remedies, are defined within locally agreed contracts. Where availability falls below the guaranteed level, remedies and any refunds are applied in accordance with the terms of the relevant contract.
• Approach to resilience: Available on request
• Outage reporting: Service outages are reported via email notifications.; ; Where an outage or service degradation occurs, affected users are notified by email with information on the issue and, where appropriate, updates on progress and resolution. Email notifications are used to ensure timely and direct communication with users. Outage communication is managed centrally to ensure accuracy and consistency of information.; ; Planned maintenance or service interruptions are communicated in advance where possible using the same email notification approach.; ; This approach ensures users are informed of service availability issues in a clear and timely manner, without requiring users to monitor external dashboards or interfaces.

Identity and authentication

• User authentication needed: Yes
• User authentication: Multi-Factor Authentication (MFA)
• Access restrictions in management interfaces and support channels: Access to management interfaces and support channels is restricted to authorised personnel only.; ; Support and administrative access is controlled using named user accounts with authenticated access. Permissions are assigned based on role, ensuring staff only have access to the systems and information required to perform their duties.; ; Access controls are reviewed regularly, and access is removed promptly when roles change or staff leave. Activity within management interfaces and support systems is logged to support monitoring and audit.; ; This approach ensures that management and support access is secure, controlled, and traceable.
• Access restriction testing frequency: At least once a year
• Management access authentication: Multi-Factor Authentication (MFA)

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: MyWay Digital Health Ltd operates an ISO/IEC 27001:2022 certified Information Security Management System (ISMS), aligned with NHS Data Security & Protection Toolkit (DSPT), Cyber Essentials, and GDPR requirements. Our policies include Access Control, Asset Management, Risk Management, Secure Development, Incident Response, Business Continuity, Cryptography, and Supplier Security. These are version-controlled and stored within our QMS.; Our QMS Forum conducts quarterly governance reviews, approves policy changes, and reviews incidents. Staff must sign annual ISMS training declarations and complete the quizzes and are evaluated. Policy adherence is enforced through onboarding and annual training, internal audits, penetration testing, regular system monitoring, and automated access logging (via Azure B2C and Sentinel). Non-conformities are logged in the ISMS Risk Register and managed through CAPA processes. Incidents are triaged, investigated, and reported per the company's policies.; We maintain segregation of duties, audit trails, least privilege access, and role-specific controls to ensure policies are implemented and verifiable. Breaches are escalated and reported within 72 hours as per GDPR Article 33.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: All platform components are tracked throughout their lifecycle via Azure DevOps and internal registers, with each item tagged to environments, version history, change logs, and test coverage. Changes are formally logged via a structured template and triaged weekly based on impact, urgency, and risk. Security implications are evaluated for every change using an ISO 14971 and DCB0129 based risk assessment process. Clinical and data security risks are flagged for RAQA review. All production changes require pre-deployment review and senior approval, with rollback plans in place. Change audit trails are maintained for traceability, aligned with our ISO27001 and ISO 13485 certifications.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: Our vulnerability management approach aligns with ISO/IEC 27001:2022 and NHS DSPT requirements. Threats are assessed through continuous internal monitoring, NHS Digital alerts, vendor advisories (e.g. Microsoft, Azure), and external intelligence sources including NCSC, SANS, and ISC2. Identified vulnerabilities are risk-assessed for likelihood and impact under our Threat Intelligence & Risk Management SOP. Medium-risk issues are addressed within standard maintenance windows (typically within 14 days). Critical vulnerabilities may trigger emergency patching under formal Change Control. All threats are logged by the RAQA Manager, reviewed jointly with the Development Manager and DPO, and validated via quarterly internal audits and annual penetration testing.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: Protective monitoring is handled by an ISO 27001-certified third-party provider who performs 24/7 logging, anomaly detection, and alerting. This includes monitoring for unauthorised access, system anomalies, and potential compromises. All high-risk alerts are escalated per SLA, with response triage initiated within 1 hour. Monthly monitoring reports are reviewed internally and stored in our ISO 13485-controlled QMS. Confirmed incidents trigger our Incident Response SOP, which includes containment, root cause analysis, and CAPA. Ongoing oversight is provided by the DPO and RAQA Manager. Monitoring coverage and incident trends are reviewed quarterly as part of our internal audit cycle and management review.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: We comply with ISO/IEC 27001:2022 and ISO/IEC 27035:2011 for incident management, supported by defined procedures outlined in our ISMS Incident Management & Reporting SOP. Our approach includes early threat detection, prompt logging, triage, escalation, root cause analysis, containment, recovery, and formal reporting. All security incidents are logged through a digital incident intake form and reviewed by the Regulatory team. Lessons learned are captured via CAPA processes. We also meet NHS DSPT requirements and maintain breach notification readiness in line with ICO expectations, including 72-hour reporting timelines and patient communication triggers when applicable.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 0%
• Between £2,500,001 and £5,000,000: 0%
• Over £5,000,001: 0%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: LRQA
• ISO/IEC 27001 accreditation date: Friday 4 August 2028
• What the ISO/IEC 27001 doesn’t cover: Our ISO 27001 certification scope excludes physical premises controls, as MyWay Digital Health Ltd operates as a fully remote organisation without centralised office infrastructure. Infrastructure is managed by our third-party infrastructure provider, who maintains their own ISO 27001:2022 certification. All logical access and monitoring, data handling, development, and support processes under our direct control are fully covered by our certification.
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 1b4aac2e-f918-4fcc-abed-ba8974eb28da
• Cyber essentials plus: No
• Cyber Essentials Alternative: In relation to the services you do not have a current and valid Cyber Essentials Plus certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials Plus certificate by one of the government approved accreditation bodies within 12 months of the date of award.
• Other security certifications: Yes
• Any other security certifications:
  • NHS DSPT
  • DTAC

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
    • Understanding barriers to access to health and social care services or employment opportunities e.g. digital inclusion
    • Inclusive and accessible recruitment practices, development practices and retention policies that support-focused activities including those provided in the Guide for line managers on recruiting, managing and developing which support people with a disability or health condition
    • Actions to invest in the physical and mental health and wellbeing of the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at louise.o'mahony@mwdh.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.