MEDINDEX LTD

Medindex

Medindex (MI) is a scalable web-based platform developed for Integrated Care Systems that provides a template for delivering clinical guidance and service information for clinicians, patients/carers at the point of care. Medindex supports users to navigate extensive and fragmented clinical pathways and services, and provides them accurate information quickly.

Features

• Searchable clinical guidance and local service directory by topic
• Content management system designed for collaboration and reduced editorial workload
• Configurable access for clinicians only, patients only, or both audiences
• Clinically designed interface for healthcare workers to use in clinic
• Integrated content management system enabling distributed topic area ownership
• User feedback tabs on every page enabling continuous improvement
• ICS wide information tailored and customised to individual place-based systems
• DTAC certified digital platform ensuring NHS security and interoperability standards
• Designed to scale and maintain usability as clinical content expands

Benefits

• Quick access to guidance and service information within patient consultations
• Send patients trusted information links directly during or after consultations
• Reduce wasted clinician time searching through emails and document repositories
• Receive weekly alerts about new clinical guidance and service changes
• Enable patients to self-refer directly to appropriate local community services
• Reduce editorial workload through collaborative content management system design
• Support clinicians to follow ICS guidelines and referral pathways
• Equity of access to information across Integrated Care Systems

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at poppyfreeman@nhs.net. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

360174867191363

Contact

Dr Poppy Freeman
07951273811
poppyfreeman@nhs.net

About your service

• Service categories:

  Applications

  Content workflow and management

  Content services

  • Content Sharing and Collaboration Applications
• Multi cloud support: Yes

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: No
• System requirements:
  • Modern web browser such as Chrome, Firefox, Safari or Edge
  • Stable internet connection for accessing platform and receiving content updates

User support

• Email or online ticketing support: Yes
• Support response times: We provide email support with responses within two working days for standard queries. Urgent technical issues are prioritised and responded to within 4 hours during business hours (Monday-Friday, 9am-5pm).; Support requests are triaged by severity, with system outages receiving immediate attention. ; Weekend queries are responded to on the next working day.
• User can manage status and priority of support tickets: No
• Phone support: No
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Standard Support (included in £12,000 annual subscription); All Medindex customers receive standard support including:; Email support via admin@medindex.co.uk during UK business hours (Monday-Friday, 9am-5pm); Response time within 2 working days for general queries; Critical issues (platform unavailability, security concerns) prioritised with 4-hour response time; Technical issue resolution and bug fixes; Standard platform maintenance and security updates; Content management system training and ongoing guidance; ; Enhanced Support (charged at £850 per day); Available for customers requiring additional support:; Clinical consultancy for strategy, content review and pathway mapping; Administrative support including weekly newsletter service, user feedback monitoring and service directory maintenance; Digital consultancy for platform customisation and feature development; Enhanced setup support for content mapping and initial content creation; Analytics and evaluation reports including website traffic analysis, user engagement metrics, top viewed pages and topics, device and browser usage, newsletter performance, platform uptime reporting,; User satisfaction surveys with quantitative and qualitative analysis, and recommendations for content and functionality improvements
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Minimal Training Required; Medindex is designed for ease of use with reduced editorial workload. Our zero-code CMS interface requires approximately 1 hour of training for content administrators. Training is delivered remotely via video conference, covering content creation, service directory management, newsletter distribution, and user permissions. We use a train-the-trainer approach, enabling your staff to build internal capacity. Session recordings and user guides are provided for reference.; End-User Access; No training is required for clinicians, patients, or carers accessing the platform. The interface is intuitive and purpose-built for quick access during 10-minute consultations, requiring no prior instruction.; User Documentation; Simple online guides are available covering CMS functionality and content management workflows for administrative users.; Implementation Support; During the 4-8 week setup period, we configure the platform, populate initial content, and prepare your team for launch through hands-on support with content structure and service directory setup according to contract.; Go-Live Support; We provide 48-hour intensive monitoring at public launch to address any immediate questions.; Ongoing Support; Email support is available via admin@medindex.co.uk during UK business hours (Monday-Friday, 9am-5:30pm). Enhanced support packages offer additional consultancy and refresher training as required.
• Service documentation: Yes
• Documentation formats: PDF
• End-of-contract data extraction: At contract end, customers can extract their data to ensure continuity of service or migration to alternative platforms.; Data available for export; All content created during the contract period can be extracted including:; Clinical articles and guidance content; Service directory entries (service names, contact information, descriptions, referral pathways); Custom content tailored to your ICS area; Export Format; Data is provided in spreadsheet format (CSV/Excel) for easy import into alternative systems or archival storage.; Export Process; Following contract termination, we provide a 30-day window for data extraction. Customers can request data exports via email to admin@medindex.co.uk during this period.; Data Deletion; After the 30-day extraction period, all customer data is securely deleted from our systems in accordance with GDPR requirements.
• End-of-contract process: Contract Termination; Either party may terminate the contract by providing 90 days written notice to expire on or after the end of the initial contract term.; Included in Contract Price; The following are included at no additional cost:; Continued platform access during the 90-day notice period; 30-day data extraction window following contract end; Data export in spreadsheet format (clinical articles, service directories, custom content); Standard technical support during the notice period; Data Extraction; Customers can request data exports via email to admin@medindex.co.uk. Export files are delivered within 5 working days of request.; Additional Costs; The following services incur additional charges:; Extended data extraction periods beyond 30 days (charged at enhanced support day rate of £850/day); Custom data formatting or migration assistance (charged at enhanced support day rate); Data Deletion; After the 30-day extraction period, all customer data is securely deleted from our systems in accordance with GDPR requirements.; Fees; No refund of prepaid subscription fees is provided on termination. Any outstanding invoices remain payable.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: There are no functional differences between mobile and desktop versions. The platform uses responsive design to automatically adapt the layout and interface to different screen sizes. All features including search functionality, clinical guidance access, service directories, content management system, and user feedback tools are available on both mobile and desktop devices. Users experience the same content and functionality regardless of device, with the interface optimised for touch navigation on mobile and traditional mouse/keyboard navigation on desktop.
• Service interface: No
• User support accessibility: WCAG 2.2 AA
• API: No
• Customisation available: Yes
• Description of customisation: Buyers can customise branding (logos, colours, design elements), content scope (which clinical topics and service areas to include), geographical coverage (tailored to ICS place-based partnerships), service directory entries, clinical guidance and pathways, and content management responsibilities for different topic areas. The platform is designed to scale, allowing additional geographical areas or clinical topics to be added over time as healthcare structures, clinical guidance or service provision evolves.; ; How users can customise:; Customisation occurs during initial platform setup through consultation with Medindex. Branding and structural elements are configured by the Medindex team based on buyer specifications. Ongoing content updates and additions are managed through Medindex's content management system, either by Medindex's editorial team or by designated buyer staff who have received training and access. New topics or geographical areas can be added as requirements change.; ; Who can customise:; Initial platform configuration is performed by Medindex in collaboration with the buyer's project leads. Ongoing content management options include: Medindex's editorial team maintaining all content, buyer's designated staff managing content after training, or a hybrid approach with specific topic areas delegated to local teams as required.

Scaling

• Independence of resources: Medindex is hosted on public cloud infrastructure within the UK, utilising scalable resources that adjust to demand. The platform architecture isolates each ICS implementation from one another; distinct database partitions and application environments, ensuring data and activity is wholly segregated. We monitor server load, response times, and uptime continuously (maintaining 99.98% uptime). If traffic increases significantly, additional server capacity is provisioned automatically. Each ICS has dedicated content storage and management capabilities. Regular performance testing and capacity planning ensure the platform maintains fast response times regardless of concurrent user numbers. Critical infrastructure components employ redundancy and self-healing to secure high availability.

Analytics

• Service usage metrics: Yes
• Metrics types: Basic usage statistics are available to all buyers on request. Comprehensive analytics and evaluation reports are available as part of enhanced support packages.; Standard metrics include website visits, page views, device types, and newsletter engagement rates.; Enhanced analytics reports provide detailed insights including user engagement patterns, most viewed pages and clinical topics, average session duration, geographical breakdown by place-based areas, newsletter performance, user feedback survey results with qualitative analysis, platform uptime, content update frequency, and specific recommendations for improvements.; Reports can be provided on an agreed schedule (monthly, quarterly, annually) or ad-hoc for specific evaluation purposes.
• Reporting types:
  • Regular reports
  • Reports on request
• Resource tagging: Yes
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: Less than once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Encryption of all physical media
• Data sanitisation process: Yes
• Equipment disposal approach: A third-party destruction service
• Data sanitisation type: Deleted data can’t be directly accessed / Cryptographic Erasure

Data importing and exporting

• Data export approach: Users can export their data by contacting admin@medindex.co.uk during the contract period or within the 30-day extraction window following contract termination. We provide data exports in accessible spreadsheet format (CSV/Excel) including clinical articles and service directory entries. Export files are prepared and delivered within 5 working days of request. The structured spreadsheet format ensures data portability and enables easy import into alternative systems or archival storage.
• Data export formats: CSV
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: Service Level Agreement:; Current delivery uptime average ≥99.5% ; Planned maintenance windows are scheduled during low-usage periods and communicated in advance via newsletter; Emergency maintenance is performed only when critical security or functionality issues arise; Monitoring and Reporting:; Platform uptime and performance are continuously monitored. Uptime statistics are tracked and available on request.; Incident Response:; Critical issues (platform unavailability, security concerns) receive prioritised response within 4 hours during business hours. Technical issues are resolved promptly with fixes deployed as needed.; Service Credits:; If monthly uptime falls below 97% (excluding planned maintenance and third-party infrastructure provider outages), customers receive service credits: ; 5% of monthly subscription for 95.0%-96.99%, and 10% for below 95.0%. ; Service credits are applied to the following month's invoice or next contract renewal period.
• Approach to resilience: Medindex is hosted on Digital Ocean's cloud infrastructure in the London datacentre, which provides enterprise-grade resilience including redundant power supplies, network connectivity, and environmental controls. The infrastructure complies with SOC 2 Type II and ISO 27001 standards.; Application-Level Resilience:; The platform architecture uses redundant application servers with automatic failover capabilities. If one server experiences issues, traffic is automatically routed to healthy servers, ensuring continuous availability.; Database Resilience:; Database systems include automated backups performed daily, with backup retention of 30 days. In the event of data corruption or loss, systems can be restored from recent backups with minimal data loss.; Network Resilience:; Cloudflare provides content delivery network (CDN) services and DDoS protection, ensuring the platform remains accessible even during network attacks or traffic spikes. Multiple network paths prevent single points of failure.; Monitoring and Response:; Continuous monitoring of server health, response times, and uptime enables rapid detection and resolution of issues. Automated alerts notify technical staff immediately when problems occur, enabling swift response to maintain service availability.; Further technical details about our resilience architecture are available on request for customers requiring more detailed information.
• Outage reporting: Medindex reports outages through the following channels:; Email Alerts:; Customers are notified of any planned maintenance in advance. In the event of unplanned outages or service disruptions, affected customers are notified directly by email with information about the issue and expected resolution time.; Direct Communication:; For critical incidents affecting service availability, customers can contact support via admin@medindex.co.uk during business hours for status updates and incident information.; Uptime Reporting:; Monthly uptime statistics are available on request. Comprehensive uptime reports including details of any outages or incidents are included in enhanced analytics packages.; Medindex does not currently provide a public status dashboard or API for outage reporting.

Identity and authentication

• User authentication needed: No
• Access restrictions in management interfaces and support channels: Access to the Medindex Content Management System requires approval. Customer organisations nominate users, and Medindex creates accounts for approved staff. Authentication requires username/password following NHS Digital Password Policy Guide and Multi-Factor Authentication for all privileged accounts. The CMS is accessible via public IP but protected by these authentication controls. Access permissions are role-based, with administrative system access logged for security purposes. Support channels operate via email (admin@medindex.co.uk) during business hours. Customers do not have direct system-level access. All technical configuration and platform changes are performed by authorised Medindex staff only, maintaining strict separation between content management and system administration.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password

Audit information for users

• Access to user activity audit information: No audit information available
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: Between 1 month and 6 months
• How long system logs are stored for: Between 1 month and 6 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: Other
• Other security governance standards: Medindex complies with NHS Digital Technology Assessment Criteria (DTAC), holds Cyber Essentials certification (renewed January 2026), and is registered with the Information Commissioner's Office (ICO) as a data controller. Our hosting infrastructure is managed by Digital Ocean, which complies with ISO 27001 and SOC 2 Type II standards.
• Information security policies and processes: Medindex follows comprehensive information security policies and processes aligned with DTAC (Digital Technology Assessment Criteria) compliance requirements:; Security Governance Framework:; Clinical Safety Officer (Dr Johnny Downs, Consultant Psychiatrist, GMC 6077613, Fellow of Faculty of Clinical Informatics) oversees clinical risk management; CEO (Dr Poppy Freeman, GP, GMC 6052512) signs off organisational risk assessments and security policies; ICO registered as data controller (Registration ZB280442); Cyber Essentials certified (renewed January 2026); Information Security Policies:; Clinical Risk Management System compliant with DCB0129 standard; Hazard Log maintained with all risks mitigated to low levels; Multi-factor authentication required for all privileged accounts; Password policies following NHS Digital Password Policy Guide; Logging and reporting requirements clearly defined with audit trails; External penetration testing (OWASP Top 10) has been conducted with no medium/high vulnerabilities identified; Internal custom code security reviews performed; Data Protection:; GDPR compliant processing of personal data (email addresses) under legitimate interest basis; Data stored and processed solely in UK (Digital Ocean London datacentre); ISO 27001 and SOC 2 Type II compliant hosting infrastructure; Reporting Structure:; All security policies and risk assessments are signed off by the CEO, with implementation risks assessed by NHS purchasing organisations within their Data Protection Impact Assessments.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Medindex uses agile development with 2-3 week sprints for technical changes and 2-3 day cycles for content updates. All code changes undergo internal security review before deployment. Version control tracks all platform components through their lifetime. Changes are assessed for security impact through our Clinical Risk Management System (DCB0129 compliant) and updated in our Hazard Log when applicable. Multi-factor authentication controls access to deployment systems. Our Cyber Essentials certification ensures baseline security controls are maintained. Platform monitoring provides continuous oversight. Major changes are tested in staging environments before production deployment. User feedback enables rapid identification of issues post-deployment.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Medindex assesses potential threats through Cyber Essentials framework compliance (renewed January 2026). Our Clinical Risk Management System (DCB0129) maintains a Hazard Log identifying and mitigating security risks. We monitor security advisories from Digital Ocean (our hosting provider), Cloudflare, National Cyber Security Centre, and software dependency alerts. Critical security patches are deployed within 48 hours of identification. Routine security updates are included in our monthly deployment cycle. All code changes undergo internal security review before deployment. Continuous platform monitoring enables rapid detection of anomalies. Automated dependency management scanning is integrated into our CICD pipelines, continuously checking and alerting on vulnerabilities.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: Medindex implements multi-layered protective monitoring combining application, network, and infrastructure monitoring. Cloudflare provides real-time threat detection, DDoS protection, and blocks malicious traffic before reaching our infrastructure. Digital Ocean monitors infrastructure health, security events, and performance metrics. Application-level logging captures all privileged account access with audit trails maintained for security review. Platform uptime and performance are continuously monitored with automated alerts for anomalies. Multi-factor authentication logs track administrative system access. Critical alerts trigger immediate investigation and response. Monthly reviews of logs and monitoring data identify potential security trends or concerns requiring attention.
• Incident management type: Supplier-defined controls
• Incident management approach: Medindex maintains pre-defined incident response processes for common events including platform unavailability, security concerns, and technical issues. Users report incidents via email to admin@medindex.co.uk during UK business hours (Monday-Friday, 9am-5pm). We also monitor security@medindex.co.uk for cybersecurity reports. Critical incidents receive prioritised response within four hours. Non-critical technical issues are responded to within two working days. All incidents are logged and tracked through resolution. For clinical safety incidents, our Clinical Risk Management System (DCB0129 compliant) ensures appropriate assessment and hazard log updates. Monthly uptime statistics are available showing performance against our 99.5% availability guarantee. Enhanced support customers receive detailed incident analysis.
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Supplier-defined process

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 2%
• Between £1,000,001 and £2,500,000: 3%
• Between £2,500,001 and £5,000,000: 5%
• Over £5,000,001: 5%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: No
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: Ccde47cd-5b5a-4e68-9858-d9d9f5b69120
• Cyber essentials plus: No
• Cyber Essentials Alternative: None of the criteria
• Other security certifications: Yes
• Any other security certifications: DTAC (NHS Digital Technology Assessment Criteria)

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
    • Understanding barriers to access to health and social care services or employment opportunities e.g. digital inclusion
    • Inclusive and accessible recruitment practices, development practices and retention policies that support-focused activities including those provided in the Guide for line managers on recruiting, managing and developing which support people with a disability or health condition
    • Actions to invest in the physical and mental health and wellbeing of the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at poppyfreeman@nhs.net. Tell them what format you need. It will help if you say what assistive technology you use.