MEDILOGIK LIMITED

MEDILOGIK EMS

EMS is an Endoscopy Reporting and departmental management software package. It covers all procedures within GI Endoscopy, Bronchoscopy and Cystoscopy as well as containing full scheduling functionality. EMS is compatible with NED 2.1 & JETS. Also inter-operable with Trust and wider eHealth systems for exchanging patient, referral and results data.

Features

• Full NEDi2.1 accreditation
• Integrated Image capture, processor agnostic
• Flexible scheduling and Vetting functionality
• One-Click generation of JAG audits
• Productivity dashboards & Capacity and Demand Reporting
• Data Extract API available to populate organisational BI tools
• Trust-wide licence - access from web-browsers
• EMS is for large regional deployments or small Private sites
• Integrates with all EPR/EHR systems and other specialist systems
• Sharing of patients clinical report with any connected NHS organisation

Benefits

• Users always access the latest EMS version, no upgrade delays
• NED data copied to JETS avoiding Trainees re-keying data
• JAG requirement of NED-JETS is met with minimum effort
• High Definition image capture; one box system for reliable capture
• Historic reports loaded and available in patient history
• Dashboard Panel provided for easy management of rescopes/surveillance &MDT episodes
• Access to e-learning & online help from within the application
• Supports move to “paperlite/paperless” endoscopy services with full pathway
• Deaths and Readmissions Audit
• Send electronic reports to GP's or regional repositories

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at accounts@medilogik.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

471752239996157

Contact

Tracy Finlayson
01473351650
accounts@medilogik.co.uk

About your service

• Service categories:

  Applications

  Production and operations

  Service industry and public sector operations

  • Healthcare
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: There are around four major software releases each year and Customers must remain on the current or previous version for application support.; ; Minimum computer specifications exist for Image Capture stations. These can be provided upon request, due to the changing nature of the hardware and software industry. Current Windows platforms are supported.; ; Please see SLA for planned maintenance arrangements etc.
• System requirements:
  • Modern (HTML5) web-browser
  • Dedicated image capture PC(s)

User support

• Email or online ticketing support: Yes
• Support response times: EMS user support is available Mon-Thu 9-5.30 and Fri 9-5 excluding B/H; a voicemail service is provided out of hours and a ServiceDesk knowledgebase is also available 24/7. Any email automatically creates a support ticket on ServiceDesk.; ; MEDILOGIK Cloud platform is monitored and supported 24/7.; ; When assistance is required relating to EMS, the request is immediately assessed & categorised as an Incident or a Fault.; ; Resolution thresholds (working hrs); Cat Priority Response Workaround Solved; 1 Urgent Immediate 2 8; 2 High 1 4 16; 3 Normal 4 8-24 16-48; 4 Low 24 24 N/A
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AA
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: MEDILOGIK provide its customers a high level of remote support, as agreed within our Service Level Agreement (available on request); dependant on organisation size as detailed in the pricing document. ; ; End user support is provided Mon-Thurs 9-5-30. Friday 9-5, excluding B/H.; ; MEDILOGIK Cloud platform is monitored and supported 24/7.; ; Customers support is available by phone: with a voicemail service out of hours. By email through a dedicated support address, or via a customer portal where users can log support requests and access product knowledge articles.; ; MEDILOGIK's comprehensive support is provided by highly experienced staff with backgrounds in application support, extensive product knowledge and technical engineers. Support requests are assigned to appropriate subject matter experts across various sectors. ; Customers have reliable and dependable ongoing support via our Customer help desk team and Customer Success team.; ; On-site support can be provided on ad-hoc basis if the query can't be rectified over telephone/ email communications. This is chargeable as per our standard day rate as detailed in our rate card in the pricing document.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Prior to project commencing MEDILOGIK hold due diligence meetings to ensure expectations around requirements and deliverables are agreed. ; ; Upon receiving the order and agreeing the scope of the project, we will guide you throughout the full deployment with:; ; - project planning, management and other project services; - remote training & e-learning; - Configuration services, process mapping and advice; - Go-live support; - Integration services; - System and User documentation; - Connecting to NED & JETS; ; Users are provided with remote training based on user roles and project deliverables. This is supported by comprehensive training documentation including training criteria and guides. ; MEDILOGIK support customers with the initial deployment and follow up to ensure training is transitioned into practical use.; MEDILOGIKs goal is to ensure that all users of EMS are competent and confident to use the software.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: At the end of the contract, data repatriation will be carried out. The data is returned to the customer free of charge in a standard output format. ; ; This will typically be in the form of an encrypted backup of the underlying SQL databases from an agreed point in time as well as a fixed term link to blob storage and is downloaded over an encrypted link i.e. HTTPS. ; ; The customer then has responsibility to share the data with the new provider.
• End-of-contract process: At the end of the contract, MEDILOGIK will follow the Data Repatriation process (available on request) in partnership with the appropriate customer. ; ; Data will be returned to the customer FOC in a standard output format. This will typically:; • An encrypted backup of the underlying files and databases from an agreed point in time; • Published via a time-based link to customer specific download area; • Downloaded over an encrypted link i.e. HTTPS. ; The customer then has responsibility to share with their new provider. ; ; Once the customer has successfully downloaded the required data as per the Data Repatriation process, the customer’s databases will be securely and irretrievably deleted. ; ; **Any export of data to a custom format will be chargeable on a time and materials basis.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
  • Other
• Application to install: Yes
• Compatible operating systems: Windows
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Mobile devices cannot be used as image capture stations. Mobile devices can be used to support the management workflow of the nursing and administration teams. The desktop service can use all of the functionality of EMS.
• Service interface: No
• User support accessibility: WCAG 2.2 AA
• API: Yes
• What users can and can't do using the API: EMS has a DataExtract API. This RESTful service allows the customers to directly execute a number of pre-defined queries in order to return data. This data is mainly used for local BI repository population and local reporting that requires cross system information.; ; Integration with customer EPRs is facilitated via an Integration API which is HL7 / FHIR based.; ; **These are additional services and costed as such.
• API documentation: Yes
• API documentation formats:
  • HTML
  • PDF
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Users have control over many configuration aspects of the system. This is applicable to both the supplied test environment and live environment.; ; Customers are required to identify a local System Administrator. The System Administrator can control user accounts including the permissions associated with system roles. They can also enable certain configuration features and the customisation aspects of scheduling data to align with their local operational and reporting requirements. These options are only accessible within the 'admin' menu of the product.; ; Best practise advice and on-going training is given as part of the project.; ; There are further configuration options that are managed by MEDILOGIK however customers can request these configuration changes via our support desk. Options are discussed and agreed during project implementation and can be amended later.

Scaling

• Independence of resources: User instances are on separate databases, separate blob storage and run in redundant web servers.; Service resource is monitored internally and externally, through a variety of systems, in order to maintain very high uptime. Automated alerts are delivered to multiple end points.; Excessive resource consumption enacts scaling plans to ensure customer usage does not affect other customers.

Analytics

• Service usage metrics: Yes
• Metrics types: Customers are offered annual Service Review Meetings as per SLA; additional Service Review Meetings can be requested.; ; Standard Agenda for these meetings:; ; - Review of key actions from previous meetings; ; - Incident overview; ; - Reviewing utilisation and services delivered; ; - Support tickets analysed against SLA but also to identify any trends and support requirements; ; - Agenda is shared in advance and AOB can be raised; ; - Customer use of EMS features is reviewed to ensure customers are utilising features to maximise efficient and benefits; ; There is ongoing monitoring of submissions to National Endoscopy Database to ensure compliance and proactive management
• Reporting types:
  • Regular reports
  • Reports on request
• Resource tagging: Yes
• FOCUS resource tagging: Yes

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Conforms to BS7858:2019
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Encryption of all physical media
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Data Erasure

Data importing and exporting

• Data export approach: Users can export their data with the correct role permissions.; MEDILOGIK EMS offers several export reporting formats:; - Standard System reports within EMS: these can be exported as Excel or PDF; - Ad-Hoc reports can be created for customers to meet a specific need on an as needed basis, the results are exported as either Excel or CSV; - Data Extract API functionality is available for purchase with documented specifications and queries
• Data export formats:
  • CSV
  • Other
• Other data export formats:
  • PDF
  • Excel
  • JSON
• Data import formats:
  • CSV
  • ODF
  • Other
• Other data import formats:
  • Excel
  • PDF
  • WORD

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: MEDILOGIK work to a greater than 99% availability within the Service Level Agreement. ; ; Availability is measured per the following monitoring periods (UK time): ; Monday to Thursday 9am to 5.30pm (8.5 hours); Friday 9am to 5pm (8 hours); ; EMS™ maintenance is normally carried out "Outside Service Cover Time". Any planned downtime during "Service Cover Time" will not be counted as unavailability if there is prior agreement with the Customer. ; ; This will be discussed with the Customer during each Service Review, and an agreed percentage of annual Support Contract Value may be deducted from the payment for the next Maintenance Period. ; ; The level of service credit to be applied will be based on the following scale: ; ; Availability Per Annum (%) Service Credit (%) ; ; 99% and over Nil ; 97% to 99% 5% ; 95% to 97% 10% ; Less than 95% 20%
• Approach to resilience: Hosted on UK data centres using zone and geo-redundant data storage, replicated to a failover instance; - Services run on high availability clusters; - All components are N+1 architecture; - Network access is 'deny by default'; ; All systems are hosted in Azure UK based data centres.; The primary hosting location is Azure UK South (London area) with distributed high availability across three physically separate data centres. A minimum of N+1 redundancy is configured for all components across these three data centres with synchronous replication for all non-ephemeral data.; ; Within each data centre, all the usual high availability options are used e.g. redundant disks, power, networking, etc.; ; Additionally, all non-ephemeral data (databases etc.) is asynchronous replicated to Azure UK West (Cardiff area) with sub-second lag and warm standby infrastructure on standby in the event of a major outage in UK South.; ; All backups are to disk with geo-replication to a remote data centre e.g. UK South backups are replicated to UK West location.; ; All infrastructure is defined as code which is stored in version-controlled fashion in Azure DevOps, also configured for high availability and disaster recovery. This includes bootstrap procedures i.e. rebuild from a complete blank canvas.
• Outage reporting: Any service outages are reported as web announcements via the customer support portal. This is used to notify users of any known or on-going service disruptions. ; Additionally our service desk manager will contact known affected key customer personnel as required.; EMS has a HealthCheck API that can be called by customer monitoring systems.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Limited access network (for example PSN)
  • Username or password
• Access restrictions in management interfaces and support channels: Access to control panel is limited to named users who require multi-factor authentication (including push notification to a mobile device) and SSL client certificate to gain access.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Dedicated link (for example VPN)

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: As per our ISO 27001 accreditation, we have an ISMS committee reporting to the Company Board. Responsibility for ensuring that policies are followed is split between roles and these roles report to the Company Board. ; Security briefings are a standing item on all Company Board meetings. ; The ISMS is available to all staff with mandatory training and follow up. Cyber Security training is regular and mandated with completion monitored and reported.; The ISMS and relevant policies are incorporated into all staff contracts.; ; We exceed the NHS Data Security and Protection Toolkit standards and have done so for a number of years. We will continue to meet and exceed these.; ; MEDILOGIK is Cyber Essentials Plus accredited.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: MEDILOGIK follow a defined & tested change management process where all components of the solution are upgraded to be no more than one version behind the current release. This is to ensure security features are current & robust and is monitored by SBOM tracking.; All new systems are tested by a dedicated in-house testing team in a non-production environment and subsequently in an isolated Production environment before being deployed to any customer sites. We record when customer systems are updated and to what version.; The weekly CAB is required to authorise ALL configuration changes for the Production environment.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: MEDILOGIK security team subscribe to all CVE feeds and assess immediately on the severity score else at the weekly security meeting. We subscribe to several commercial threat intelligence services.; ; Our CyberEssentials Plus and ISO 27001 require that we maintain constant, very high levels of patching including:; Automated Endpoint management; Routine Endpoint scanning and alerting; SIEM / XDR; ; Through this we deploy patches no later than 14 days after disclosure, in practice this happens across our services for critical vulnerabilities within 48 hours.; Our Secure Development policy ensures that vulnerabilities in software dependencies are checked with every build cycle.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: CyberEssentials Plus and ISO 27001 require that we maintain constant, high levels of patching and Endpoint monitoring via SIEM / XDR solutions. ; Our WAF also monitors all network traffic and feeds into the SIEM / XDR.; The SIEM / XDR implements OWASP, CE+, CIS and other rulesets. ; ; We subscribe to commercial threat intelligence services to be informed of any potential compromise discovered externally and any current exploits in the wild.; ; On discovery of potential compromise the security team immediately raises to the Technical Director and an incident team is formed. Incident is handled per our Business Continuity and Security Policies.
• Incident management type: Supplier-defined controls
• Incident management approach: MEDILOGIK has a pre-defined process for reporting data breach incidents, incidents identified by our 'system monitoring' and any customer reported incidents. ; Users can report incidents via our support help: phone, email or customer portal; MEDILOGIK act as a data processor, therefore we notify the data controller as soon as possible in line with our documented process and legal obligations of the ICO. (notification by e-mail and telephone, request confirmation of notification by e-mail).; Operation policy requires root cause analysis and resulting report is shared with customers
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: Yes
• Connected networks: Health and Social Care Network (HSCN)

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0.5%
• Between £250,000 and £500,000: 0.5%
• Between £500,001 and £1,000,000: 1%
• Between £1,000,001 and £2,500,000: 1%
• Between £2,500,001 and £5,000,000: 1%
• Over £5,000,001: 1%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: Alcumus ISOQAR Limited,
• ISO/IEC 27001 accreditation date: Wednesday 30 April 2025
• What the ISO/IEC 27001 doesn’t cover: Nothing - all the organisation was in scope.
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: Alcumus ISOQAR Limited,
• ISO 9001 accreditation date: Wednesday 30 April 2025
• What the ISO 9001 doesn’t cover: Nothing - all the organisation was in scope.
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 9a426df4-1f6d-4e26-bbec-c00c8b57caf9
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: Ebbb0746-f2d7-4900-9601-7a44a5fe418d
• Other security certifications: Yes
• Any other security certifications: DSPT : 2024-25 (version 7) - Standards exceeded

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
    • Plans to engage the contract workforce in deciding the most important workplace issues to address
    • Ensuring new workers are informed of their right to join a trade union
    • Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
    • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
    • Activities to cascade good practice on fair working conditions throughout the supply chain
    • Offer a pay and leave entitlement to all eligible staff who become kinship carers, ideally equivalent to statutory adoption pay and leave
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible
    • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
    • Volunteering opportunities for staff
    • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors
    • Outline policies and practices to be applied to or put in place for the contract to mitigate and manage modern slavery risks, including: Pre-employment checks, recruitment practices. Workplace conditions, safeguarding plans and processes in place and regular monitoring with relevant groups considered, which may include sampling
    • How to ensure business decisions re: price/cost, short lead times, payment timescales do not create modern slavery risks in the supply chain

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

    • Understanding of employment and relevant skills issues, and of the education and training issues relating to the contract. Illustrative examples: demographics, skills shortages, new opportunities in high growth sectors, geographic/local community and skills/employment challenges
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

    • Understanding of the types of businesses in the market and the level of participation by new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutuals
    • Activities to identify opportunities to open up sub-contracts under the prime contract to a diverse range of businesses, including new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutuals
    • Understanding of local demographics, needs and opportunities for the co-design of the goods, services and works to be delivered under the contract

  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Delivery of additional environmental benefits through the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Understanding of how to influence staff, suppliers, customers, communities and/or any other appropriate stakeholders through the delivery of the contract to support climate and nature protection and improvement

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 6: Employment and training: For those who face barriers to employment

    • Understanding of employment and skills issues, and of the skills and employment shortages of high growth sectors relating to the contract
    • Understanding of the issues affecting the representation of disabled people in the workforce in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
    • Inclusive and accessible recruitment practices, and retention-focused activities, including those provided in the Guide for line managers on recruiting, managing and developing people with a disability or health condition
    • Working conditions which promote an inclusive working environment and promote retention and progression
    • Inclusive and accessible development practices, including guidance for line managers on recruiting, managing and developing people with a disability or health condition

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 7: Creating a pipeline of opportunities: For the contract workforce, reducing barriers to entry for under-represented groups.

    • Understanding of the issues affecting the development of new skills by target cohort
    • Understanding of issues relating to entering the contract workforce

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
    • Inclusive and accessible recruitment practices, development practices and retention policies that support-focused activities including those provided in the Guide for line managers on recruiting, managing and developing which support people with a disability or health condition

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at accounts@medilogik.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.