GRADE GROUP LIMITED

D-CETR

A Complete digital delivery platform for C(E)TRs. A centralised and secure service efficiently delivering the C(E)TR process across accessible web and mobile channels, in a manner open to young people and their support circle. Ensuring effective engagement, improved patient outcomes through continuity of service and progressive support, and operational efficiency,

Features

• Secure data management
• Secure document management
• Streamlined CETR set-up
• Automated document management
• Streamline CETR panel identification and management
• Accessibility
• Automated performacne reporting
• Automated operation reporting
• Data insights
• Fully auditable process

Benefits

• Operational efficiency, reducing staff required for CETR process
• Secure centralised data and reporting
• Secure access across mobile and desktop devices
• Accessible and inclusive service + content including multi=language support
• Continuity of service
• Intelligent panel matching and management

• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at hello@gradegroup.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

402417987799092

Contact

Robert Hawkins
07724100151
hello@gradegroup.co.uk

About your service

• Service categories:

  Application Development and Deployment

  Application platforms

  • Model driven application platforms
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model: Hybrid cloud
• Service constraints: None
• System requirements:
  • Modern desktop or web enabled mobile device
  • Modern web browser

User support

• Email or online ticketing support: Yes
• Support response times: We respond within 24 hours Monday to Friday.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 A
• Phone support: No
• Web chat support: No
• Onsite support: No
• Support levels: We provide second line technical support for our clients via a ticketing and email based service. ; ; We provide automated service updates and status alerts.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: We offer two 2-hour online training workshops to enable onboarding and user training for each client.; ; In addition, for a 1-month inception period, we provide a dedicated account holder to support teams as they familiarise themselves with the service. During this period our account holder will be available via telephone and email.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: In keeping with GDPR and our commitment to best practice, as data processor we offer our clients (as data controller) the option for complete deletion of their data or a secure FTP transfer of data as either CSV, JSON or XML file. We make this service available for a period of 30 days after termination or expiry of the contact. Following this period we will delete any remaining data.
• End-of-contract process: 1. Termination Assistance Period. ; For a period of thirty (30) days following the effective date of termination or expiration of the contract (‘The transition period’), we maintain client data and will make it available for retrieval in agreed format (CSV, JSON, or XML). During this period, we grant client limited access to the services solely for the purpose of exporting or downloading their data at no additional cost.; ; 2. Return of Confidential Information. ; Within the Transition Period, at our client’s request, we will return or destroy all physical or electronic copies of the other party’s Confidential Information, including any data residing in our production systems.; ; 3. Data Sanitization and Deletion. ; On conclusion of the Transition Period, we shall have no further obligation to maintain client data. We shall permanently delete or pseudonymise client data such that it cannot be reconstructed. Upon request, we shall provide a certificate signed by an officer confirming that the deletion has been completed.; ; 4. Post-Termination Fees. ; Our client shall remain liable for any undisputed fees or overages incurred up to the effective date of termination. No further subscription fees shall accrue during the Transition Period, provided the client's use is limited strictly to data retrieval.
• Documentation accessibility standard: WCAG 2.2 A

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Our service is full responsive and there is no functional or accessibility difference between mobile and desktop.
• Service interface: No
• User support accessibility: WCAG 2.2 A
• API: Yes
• What users can and can't do using the API: We offer a flexible API tier to allow integration with third-party services. This is configured on a contract-by-contract basis
• API documentation: Yes
• API documentation formats: Open API (also known as Swagger)
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: We allow customisation message content and mail service integration as standard; ; In addition, we provide bespoke modification, development and customisation at addition cost. Here, our multidisciplinary team is able to offer a complete end-to-end software lifecycle service from requirements capture through to design, implementation, testing and refinement.

Scaling

• Independence of resources: Our service is delivered through Microsoft Azure

Analytics

• Service usage metrics: Yes
• Metrics types: We provide the following metrics:; Number of C(E)TRs initiated; Number of C(E)TRs completed; Number of C(E)TRs currently live
• Reporting types: Real-time dashboards
• Resource tagging: Yes
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: None

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Encryption of all physical media
  • Scale, obfuscating techniques, or data storage sharding
• Data sanitisation process: Yes
• Equipment disposal approach: A third-party destruction service
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Data Erasure
  • Physical Destruction / Hardware containing data is completely destroyed

Data importing and exporting

• Data export approach: Subject to robust role based user authentication, authorised users are able to routines download their data via the platform interface.
• Data export formats: CSV
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • Private network or public sector network
  • TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: Our platform is delivered through MS Azure, with a '4 nines' availability (99.99% uptime). With an SLA of a maximum of 1 hour of total downtime per year.
• Approach to resilience: Our platform is hosted on Microsoft Azure and engineered to leverage resilience features including Availability Zones, geo-redundant storage, and Azure Site Recovery, to protect against datacenter or regional failures and ensure business continuity.
• Outage reporting: We provide automated email alerts to our clients and provide each client with a dashboard providing key metrics including current system status and up time

Identity and authentication

• User authentication needed: Yes
• User authentication: Multi-Factor Authentication (MFA)
• Access restrictions in management interfaces and support channels: Access restrictions and approach are set out in our Access Control Policy (V1.0) available upon request. in summary:; ; User access controls and processes must: ; ; Be based on the principles of least privilege and need to know basis ; ; Ensure that accounts are enabled only for the duration required ; ; Allow for the timely provision, update and removal of access when users join, move or leave ; ; Be reviewed and maintained on a regular basis ; ; Ensure user access management activity is recorded to provide an audit trail ; ; Disable default accounts and change default passwords; and ; ; Always comply with legal, regulatory or contractual requirements
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: No
• Security governance approach: Our robust security governance approach integrates risk management into the SDLC through automated compliance checks and continuous monitoring. Within this model our product engineering assumes a Zero Trust architecture, enforces least-privilege access, and maintains strict data encryption. Regular third-party audits and a proactive incident response plan ensure long-term confidence for our clients
• Information security policies and processes: We are Cyber Essentials certified and our robust ISS is aligned with ISO 27001 best practice.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: All configuration and change management procedures are documented in our ISMS with our Change Management Policy (V1.1) which is available upon request. In summary:; ; Any Change to a service or service component shall be applied by the Technical Director on their sole authority. ; As such: ; ; Identification of significant changes to information security systems must be recorded.; ; An impact assessment of changes must be carried out and have a formal approval procedure, to ensure that information security requirements are being met; ; ; Changes must be risk assessed by the Technical Director to identity key risks associated
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Our approach is set out in our Vulnerability Management Policy (V1.0) which is available on request. In summary:; ; Identifying vulnerabilities will be through employees, penetration test results and any 3rd party suppliers. The Technical Director will collect information about symptoms and impact, log them in the event log, and assess whether the reported event is a vulnerability. ; ; When a vulnerability – either a material vulnerability or a vulnerability, the Analyst will inform the Technical Director who will follow the Incident Management Plan. ; ; All vulnerabilities will be treated as each constitutes a Major Security Incident.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: We continuously track user activity, configuration drift, and data access. We utilise an automated Security Posture Management (SSPM) to identify misconfigurations and identity risks in real-time. Integrated logs ensure accountability and rapid incident response (in accordnacy with our Incident response policy)
• Incident management type: Supplier-defined controls
• Incident management approach: Our incident management approach is set out in our Incident Response and Management Plan (1.2). which is available upon request. Here we set out a flexible and robust approach around the principle of identifying named senior staff responsible for :; ; Incident must be declared by who? ; ; Impact analysis should be conducted by who? ; ; Incident can only be terminated/closed down by who? ; ; Minimum documentation should be what? ; ; Who should be informed of an incident?
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Conforms to a recognised standard, but self-assessed

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: Yes
• Description of free trial: We offer a discretionary free trail options for client. This usually takes the form of full access to platform to allow an agreed number of reviews to be undertaken (3).

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 5%
• Between £250,000 and £500,000: 10%
• Between £500,001 and £1,000,000: 12%
• Between £1,000,001 and £2,500,000: 15%
• Between £2,500,001 and £5,000,000: 20%
• Over £5,000,001: 20%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: No
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: No
• Cyber Essentials Alternative: In relation to the services you do not have a current and valid Cyber Essentials certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials certificate by one of the government approved accreditation bodies within 12 months of the date of award.
• Cyber essentials plus: No
• Cyber Essentials Alternative: In relation to the services you do not have a current and valid Cyber Essentials Plus certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials Plus certificate by one of the government approved accreditation bodies within 12 months of the date of award.
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding barriers to access to health and social care services or employment opportunities e.g. digital inclusion
    • Actions to invest in the physical and mental health and wellbeing of the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at hello@gradegroup.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.