iaptus
iaptus is a digital care record, customisable to meet the requirements of community and mental health services including; psychological therapies, staff mental health, university counselling, gambling harms, diabetes remission, cardiovascular disease prevention and weight management services. iaptus supports case management, service workflows, outcome measurement, data analytics and reporting.
Features
- Customisable: Local configuration including list management, fields, labels and templates
- Interoperable: API’s enabling integration/in-context views with existing systems
- Care pathways: Patients tracked along customisable pathways, reflecting service workflows
- Minimum Data Set (MDS) - collection/reporting at local/national levels
- Analysis: In-built reports to review patient and service level data
- Measurement Based Care: Questionnaire results at/sent prior to appointment
- Case/Clinical risk management: Including alerts and supervision module
- Online referrals: Service integrated patient and healthcare professional referral forms
- Online patient engagement: Appointment booking, questionnaires, B2C therapy platform accessibility
- Patient/stakeholder communication: SMS, hybrid mail, GP electronic letters, video
Benefits
- Flexible: Configured to support a variety of service types
- Networked: Integrations facilitate joined up care and seamless user experience
- Adaptable: Customisable care pathways improve care quality
- Intelligent: Analysis tools review and measure quality improvements
- Patient centred: Records and monitors patient outcomes and recovery rates
- Safe: Reduces clinical risk by using custom labels and alerts
- Value generating: Communication tools bring direct and indirect cost savings
- Innovative: Provides patients with direct access to 3rd party platforms
- Efficient: Streamline tasks with productive features e.g. bulk actions
- Intuitive: Logical user navigation supports services handle large patient numbers
Pricing
£150.80 to £752.00 a licence a year
Service documents
Request an accessible format
Framework
G-Cloud 14
Service ID
4 8 9 0 0 4 1 7 8 8 7 1 9 6 6
Contact
Mayden
Chris May
Telephone: 01249 701100
Email: chris.may@mayden.co.uk
Service scope
- Software add-on or extension
- No
- Cloud deployment model
- Public cloud
- Service constraints
-
Mayden conducts scheduled monthly maintenance to our hosting environment. Customers are notified of changes and alerted to likely impacts. Changes are made out-of-hours to minimise impact.
Mayden will support the current and previous major releases of Firefox®, Safari®, Microsoft® Edge™ and Google® Chrome™ on a rolling basis. As each new version of a browser is released, Mayden will begin supporting that version and stop supporting the third most recent version. - System requirements
-
- Supported web browser (see response above)
- At least 1-2Gb RAM
- Javascript and cookies to be enabled on browsers
- Stable internet connection, recommended 1Mb
- Currently supported Microsoft operating systems
- Currently supported Apple operating systems
User support
- Email or online ticketing support
- Email or online ticketing
- Support response times
-
All queries registered via support log will be responded to within 2 days (excluding bank holidays and weekends).
Requests relating to system unavailability will be assessed with an appropriate “Priority Type” assigned. The Mayden “Priority Type” matrix, with target day time response, is between 1 hour for high priority and 8 hours for low priority.
Support hours are between 9:00 - 17:00 Monday to Friday, with phone lines operated between 08:00 - 18:00 Monday to Friday. - User can manage status and priority of support tickets
- Yes
- Online ticketing support accessibility
- None or don’t know
- Phone support
- Yes
- Phone support availability
- 9 to 5 (UK time), Monday to Friday
- Web chat support
- No
- Onsite support
- Yes, at extra cost
- Support levels
-
Customers have access to Mayden’s comprehensive single tier support team as well as being assigned a dedicated account manager. All iaptus users also have access to the comprehensive iaptus help site, which includes step-by-step tutorials and videos.
The iaptus support log is built into iaptus. Users log their issue and can track, update and sign-off and rate the service received. Updates to support log items are automatically sent to the user and your designated iaptus account manager via email. This provides full and efficient transparency of all support requests logged.
Support hours are between 9:00 - 17:00 Monday to Friday, with phone lines operated between 08:00 - 18:00 Monday to Friday. The first point of contact is the reception or account management teams. Emails may be responded to out of hours, but this is not guaranteed.
Response times to requests vary depending on the nature of the request. However, all queries will receive an initial response within 2 working days. Requests relating to system unavailability will be responded to within 1 and 8 hours depending on the level of urgency. More information may be found in our service level agreement (SLA). - Support available to third parties
- Yes
Onboarding and offboarding
- Getting started
-
Mayden has a track record of over 200 implementations of iaptus. We have developed effective and efficient processes to ensure set up runs smoothly.
Mayden co-creates a Project Initiation Document (PID) with the service, outlining the configuration, phases, actions, owners and intended weeks of completion. A dedicated project manager will support each customer with their transition to iaptus. During the configuration phase, we work through a rehearsed process to ensure the system is set up to meet the customer’s requirements.
Customers are provided with a “demo/training” environment where configuration of the system starts in a safe environment. Patient data is tested and correct, appropriate add-ons are available immediately and the configuration of the iaptus instance is as expected. Only once both the data and site have been accepted by the sign-off authority in writing will the product be deployed.
Full system training is provided, including dedicated reports and super user training. Users have access to the comprehensive iaptus help site which includes step-by-step tutorials and videos. Each service is assigned a dedicated account manager to offer additional help and guidance. This support is available from the start, and throughout, the duration of the contract. - Service documentation
- Yes
- Documentation formats
-
- HTML
- Other
- Other documentation formats
-
- .doc
- .docx
- End-of-contract data extraction
-
The customer is the Data Controller, and we will always act on their instructions. Mayden will liaise with the customer to facilitate the safe transfer of confidential patient data to the customer. Services have two extract options when the contract ends.
The first option is a number of CSV files which contain all patient records. The files can then be exported to a separate data warehouse or alternative system.
Alternatively, for an additional cost we can download and provide a summary of each patient record in an archivable format such as PDF. This will include appropriate lookup tables for ease of use when providing information about a specific patient.
Mayden will remove all patient identifiable data from its systems within 90 days of service termination. However, before all data is removed, Mayden must notify the customer of this intent and receive confirmation from the customer before deleting the relevant data. - End-of-contract process
-
The customer is the Data Controller, and we will always act on their instructions. At the end of the contract we will discuss with you what you would like us to do with the data we store. We will arrange for a system closure date and data transfer date.
If the data is requested as a number of CSV files, there is no additional charge. There is an additional charge for a summary of each patient record as a PDF.
Mayden will remove all patient identifiable data from its systems within 90 days of service termination. However, before all data is removed Mayden must notify the customer of this intent and receive confirmation from the customer before deleting the relevant data.
Using the service
- Web browser interface
- Yes
- Supported browsers
-
- Microsoft Edge
- Firefox
- Chrome
- Safari
- Application to install
- No
- Designed for use on mobile devices
- Yes
- Differences between the mobile and desktop service
- Iaptus patient facing features have been designed to work on mobile devices. iaptus patient management functionality is designed to be used on a desktop via a modern browser. Some iaptus patient management functionality, like questionnaires and graphs, can be used on a tablet device.
- Service interface
- Yes
- User support accessibility
- None or don’t know
- Description of service interface
- Iaptus is a cloud based patient management system. Its user interface is web based and all features are accessed through a supported internet browser.
- Accessibility standards
- None or don’t know
- Description of accessibility
-
The product team, encompassing product owners, developers and designers, work collaboratively when implementing new features. This helps to ensure all new developments are accessible, intuitive, and designed with user involvement and feedback. This collaboration helps support continuous improvement and inform future system usability. We work towards, at a minimum, WCAG 2.2 AA when developing new features.
Our accessibility work prioritises the areas of the system that are most used by those most impacted. This means that patient-facing and high traffic areas are prioritised.
All new developments are deployed meeting the minimum standard (currently WCAG 2.2 AA). - Accessibility testing
- Before deploying any new code that impacts the user interface, we test that screen reading technology works, specifically Voiceover, with our new developments. We do not currently test with users who use assistive technology.
- API
- Yes
- What users can and can't do using the API
- Detailed API documents are available on request. Existing implementations using our API suite include; sending referrals, viewing and retrieving data, sending and receiving data to and from external platforms (including online therapy providers).
- API documentation
- Yes
- API documentation formats
-
- Open API (also known as Swagger)
- Other
- API sandbox or test environment
- Yes
- Customisation available
- Yes
- Description of customisation
-
Iaptus is designed to be as flexible as possible, tailored to meet the needs of each service. iaptus has a workflow, designed over many years of use, supporting services to collect high quality data.
The system is built around a custom care pathway, reflecting service operations as they evolve. The pathway underpins iaptus, prompting users to the next logical step when treating a patient. iaptus’ navigation, each patient record generated and all data collection, builds from this pathway.
A control panel allows local customisation. Almost every drop down menu and checkbox can be controlled and updated. List Management tools control the answer options available in almost all fields, designed around the data a service wants to collect. Fields can be set to mandatory or optional. New options can be added, mapped to national datasets and re-ordered.
Custom assessments allow users to record a clinical opinion and risk(s) of the patient. Labels may be created and edited to flag patient characteristics/requirements. Clinical session notes templates can be configured, supporting consistency of care by standardising clinical notes.
Patient engagement features such as SMS, outcome measures/questionnaires, online referral forms and letters are all customisable.
Scaling
- Independence of resources
- The architecture of our hosting allows new application servers to be added to the load balancers. Therefore, if demand increases, capacity can also be increased.
Analytics
- Service usage metrics
- Yes
- Metrics types
-
Iaptus contains built-in dashboards and a reporting suite that can be used to monitor service usage metrics. The reporting suite produces standard reports and enables users to apply filters and split the data by a range of parameters to generate custom reports.
Service usage metrics include: audit history of user logins; audit history of user actions including adding, editing, printing, deleting, viewing, reinstating records; usage of add-on features; and many more. - Reporting types
-
- API access
- Real-time dashboards
- Regular reports
- Reports on request
Resellers
- Supplier type
- Not a reseller
Staff security
- Staff security clearance
- Other security clearance
- Government security clearance
- None
Asset protection
- Knowledge of data storage and processing locations
- Yes
- Data storage and processing locations
- United Kingdom
- User control over data storage and processing locations
- No
- Datacentre security standards
- Managed by a third party
- Penetration testing frequency
- At least once a year
- Penetration testing approach
- Another external penetration testing organisation
- Protecting data at rest
-
- Physical access control, complying with SSAE-16 / ISAE 3402
- Scale, obfuscating techniques, or data storage sharding
- Data sanitisation process
- Yes
- Data sanitisation type
-
- Explicit overwriting of storage before reallocation
- Deleted data can’t be directly accessed
- Equipment disposal approach
- In-house destruction process
Data importing and exporting
- Data export approach
-
Mayden provides the option of full nightly extracts from iaptus. The format of the extract data is a series of flat files (Tab delimited) for different tables. Corresponding XML files provide the structural data. These can be picked up daily, scripted through a system interface to automate the download into a local data warehouse. A user may also download a full nightly extract if ad-hoc reporting options are required.
The extracts are well documented (including ERDs) and contain tables at all levels of the clinical record. These include demographics, referrals, assessments, appointments, clinical contacts and outcome measures. - Data export formats
-
- CSV
- Other
- Other data export formats
- Null separated values (NSV)
- Data import formats
-
- CSV
- Other
- Other data import formats
- Other SQL database formats
Data-in-transit protection
- Data protection between buyer and supplier networks
-
- Private network or public sector network
- TLS (version 1.2 or above)
- Data protection within supplier network
-
- TLS (version 1.2 or above)
- IPsec or TLS VPN gateway
Availability and resilience
- Guaranteed availability
-
Our service level agreement (SLA) is available on request.
iaptus has a target uptime of 99.7%, any incident is recorded along with the impact and duration.
All calls escalated by customers are assessed and prioritised from High to Low, with response times ranging between 1 to 8 hours. Fix time targets are between 4 hours to 4 days, depending on the nature of the problem. Complete system unavailability is automatically treated as a high priority with a target maximum fix time of 4 hours. Most issues are resolved in minutes.
Mayden naturally takes a proactive approach to customer satisfaction. Quarterly contract review meetings are held with customers, providing an opportunity to review system performance and response(s) to support logs. Example KPI’s covered in the quarterly review include:
- Overall system availability
- System availability by feature
- System response times
- Time to first response for support logs
- Customer satisfaction on each log
- Logs raised by subject area to help identify area for support and training - Approach to resilience
-
A combination of Amazon EC2, High Availability Galera Database clusters and utilities are used to gain accurate point in time recovery points with backups in geographically distinct data centres (3 AWS Availability Zones (AZ)). Daily and hourly database backups are captured and stored in 3 AZ's and binary/transaction logs are also captured, allowing recovery of data within seconds of a significant database failure.
Customer and system data stored within the database is held in 3 node Galera database clusters. This provides real time replication across each of the 3 nodes with real time failover between nodes and automatic integrity monitoring to prevent data loss or corruption. ProxySQL acts as a database load balancer to enable real time failover between database cluster nodes. In effect, an RTO of 0 in the case of a database failure.
In addition to database redundancy, iaptus has multiple application servers with load balancers for each. This allows immediate failover from one server to another should one fail; in effect an RTO of 0. In most circumstances, users won’t notice when iaptus manages itself, as the switch is automatic.
Further information on the resilience of our service can be made available upon request. - Outage reporting
-
We have a live status page for our applications that users can access at any time. Communication is also shared directly to a key contact nominated by each customer. This is sent via email from either the Mayden product owners and/or each customer's dedicated account manager. Users may also contact Mayden for status updates via our phone line.
Following any outages, customers can request a Root Cause Analysis report. This report contains further details, including the mitigations put in place to prevent further outages.
Identity and authentication
- User authentication needed
- Yes
- User authentication
-
- 2-factor authentication
- Public key authentication (including by TLS client certificate)
- Limited access network (for example PSN)
- Other
- Other user authentication
- Users will either authenticate through a 2FA portal (if accessing over the public internet) and then authenticate with the application, or authenticate directly with the application if accessed over a government network (ie HSCN).
- Access restrictions in management interfaces and support channels
- We restrict access to production systems by job role and on a “need to know basis” within the company. For example, developer teams do not have access to the same number of systems, or to the same level, as the systems team.
- Access restriction testing frequency
- At least once a year
- Management access authentication
-
- 2-factor authentication
- Public key authentication (including by TLS client certificate)
- Dedicated link (for example VPN)
- Username or password
Audit information for users
- Access to user activity audit information
- Users have access to real-time audit information
- How long user audit data is stored for
- At least 12 months
- Access to supplier activity audit information
- You control when users can access audit information
- How long supplier audit data is stored for
- At least 12 months
- How long system logs are stored for
- Between 6 months and 12 months
Standards and certifications
- ISO/IEC 27001 certification
- Yes
- Who accredited the ISO/IEC 27001
- The British Standards Institute
- ISO/IEC 27001 accreditation date
- 24/07/2015
- What the ISO/IEC 27001 doesn’t cover
- All departments within Mayden are included in the scope of certification. Individual product lines designed by Mayden are not included within the scope of certification.
- ISO 28000:2007 certification
- No
- CSA STAR certification
- No
- PCI certification
- No
- Cyber essentials
- Yes
- Cyber essentials plus
- Yes
- Other security certifications
- No
Security governance
- Named board-level person responsible for service security
- Yes
- Security governance certified
- Yes
- Security governance standards
-
- ISO/IEC 27001
- Other
- Other security governance standards
-
Cyber Essentials
Cyber Essentials Plus
Data Security and Protection Toolkit - Standards Exceeded - Information security policies and processes
-
We are accredited to ISO27001 and have policies and controls in place in order to manage risks and threats across all projects.
To ensure compliance with ISO27001 and the NHS Data Security and Protection Toolkit, we have a full Information Security Management System in place. This consists of 30 policies that all staff have to comply with.
These policies include: Information Security Policy, Risk Management, Internal Audit Plan, Business Continuity, Clear Desk and Screen, Email Security and Acceptable Use, Laptop and Portable Device Security, Physical Access to Information Systems, Confidentiality Code of Practice, Personal Information Handling, Network and Router Security, Document and Record Control, Record Retention and Disposal, IT & Software, Development Change Management & Control, Principles for Secure System Engineering, Software Update and Patch Policy and Server Network and Laptop Computer Malware Management.
Staff have to complete a quarterly IG checklist to verify compliance and sign a declaration to this effect. This, along with the policies, are audited for compliance by our information security officer who is a qualified lead auditor. The information security officer reports to the information governance lead who is also the managing director.
Operational security
- Configuration and change management standard
- Supplier-defined controls
- Configuration and change management approach
- Changes are tracked through GitHub and our issue tracking tool Jira. This ensures that all automated tests are run on every change. Manual testing is also performed on every change in accordance with ISO27001, control A8.28 for secure coding. Risks are then assessed in accordance with our clinical risk policy. Appropriate action is taken to reduce risk to an acceptable level.
- Vulnerability management type
- Supplier-defined controls
- Vulnerability management approach
-
We conduct internal vulnerability assessments to assess the risk we expose our environment to. This is backed by Common Vulnerabilities and Exposures (CVE) and The National Vulnerability Database (NVD) security bulletins. These bulletins are delivered to us daily. We have tooling for real time monitoring of our infrastructure.
Internal processes facilitate the triage and patching process within 48 hours of a vulnerability being identified. - Protective monitoring type
- Supplier-defined controls
- Protective monitoring approach
-
We conduct red team exercises at regular intervals and vulnerability scanning weekly. Internal QA and sign off processes facilitate the secure development of new areas of the system. Vulnerability scanning tools/techniques identify issues in previous deployments.
We are subscribed to National Cyber Security Centre (NCSC) Early Warning alerts and regularly receive cyber alerts from NHS England. Monitoring solutions in our environment gives real time alerts to any malicious activity. Should any alert suggest an active compromise, a cross-functional security incident response team will be formed to manage and contain the incident. - Incident management type
- Supplier-defined controls
- Incident management approach
-
All incidents are added to our internal CRM System and communicated to the customer as appropriate. The customer is regularly updated with the proposed corrective and preventive actions.
In accordance with Mayden’s service level agreement (SLA), incidents involving system unavailability are reported to the customer, within 1 and 8 hours depending on the severity. Incidents are reviewed at quarterly IG group meetings to ensure that corrective and preventive action is implemented. This includes identifying possible trends and ensuring root cause analysis has been undertaken effectively. Incidents are monitored by the information security and assurance leads.
Secure development
- Approach to secure software development best practice
- Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v3.0)
Public sector networks
- Connection to public sector networks
- Yes
- Connected networks
-
- Health and Social Care Network (HSCN)
- Other
- Other public sector networks
- Internet
Social Value
- Social Value
-
Social Value
- Fighting climate change
- Tackling economic inequality
- Equal opportunity
- Wellbeing
Fighting climate change
Mayden is committed to measuring and disclosing Scope 1, 2 and 3 carbon emissions. Our Carbon Reduction Plan (CRP), completed in accordance with relevant guidelines by our dedicated Sustainability Working Group (SWG) commits us to achieving Net Zero (NZ) emissions by 2050. The West of England Combined Authority (WECA) carbon survey of our offices (2023) informs our carbon reduction projects and provides baseline measurements. We aim to reduce emissions by 50% by 2030. A 10% reduction year-on-year will enable us to meet this target. This year we upgraded our office lighting to LEDs which is expected to save 4.8tCO2e.
Scope 1: We have no direct emissions from developing our product. Our customer-facing applications are cloud-hosted, so fall under Scope 3. We have prioritised the five Scope 3 categories required by the NHS for 2024 and are looking to measure and report our hosting emissions as we grow and develop our CRP.
Scope 2: 2023 was our first year of reporting office energy use calculated from energy bills so emissions for this year reflect our baseline data. Working from Home (WFH) emissions data is estimated using ‘UK Government GHG Conversion Factors for Company Reporting’ 2023.
Scope 3: Our highest priority is to measure and reduce a subset of our emissions including business travel and employee commuting. We do not have emissions from upstream or downstream transportation. Our office waste is negligible. Timesheets and expense reports inform business travel data. Employee commuting values were obtained from a 2023 staff survey for which we got a 75% return rate.
We help reduce our clients carbon footprint by:
- Reducing reliance on paper and courrier emissions through our digital features of electronic letter sending and webforms
- Reducing travel emissions by enabling service users to be seen via online video appointmentsTackling economic inequality
We are dedicated to supporting our workforce, and the local economy, to grow. Mayden has grown and invested consistently during its history. Since launching iaptus, in 2008 with 7 employees, we now employ over 130 FTE. We recruit in line with our sustainable growth plans and have plans for significant development of iaptus. Mayden’s growth has also come from launching an academy which trains aspiring software developers and data scientists. Graduates can then apply for entry-level positions, not just at Mayden, but for any company.
Roles at Mayden cover wide ranges of skills and expertise, including: customer account managers, software developers, systems engineers, data service engineers, data scientists, HR, marketing, sales and administration. All employees receive a comprehensive learning and development offering, including 1-2-1 coaching. Employees also receive individual training budgets and have access to an additional training community pot. These budgets support employees achieve further formal qualifications.
We invest in future leadership development, sponsoring 2 employees per year to undertake a comprehensive training programme run by a local community interest company. This involves designing and delivering a social community project to benefit their own development and the city. Other local initiatives include the Bath Digital Divide Collective, a group of organisations working together to address digital poverty in Bath.
Our employment offer is flexible, including part-time, job-share and flexible working requests. We offer university student placements, which often lead to permanent roles. This helps retain the graduate workforce, a significant challenge in the South West.
We have supported initiatives including the Women’s Work Lab, who support mothers who have not been employed for some time back into the workplace. As we continue to grow, we will ensure we provide recruitment opportunities for all candidates in line with our equality, diversion and inclusion (EDI) policy.Equal opportunity
Our equality, diversity and inclusion (EDI) policy outlines our commitment to the Equality Act 2010, and our approach to non-discrimination in all Mayden’s employment aspects. A dedicated EDI group regularly reviews and operationalises the policy. We recruit and hire for gender diversity, and recently ran a diversity monitoring survey which has provided evidence on where we can best put our efforts to tackle inequality resulting in initiatives like experimenting with new hotdesking protocol and running awareness campaigns for Autism Awareness Week and LGBT History Month.
We are a signatory to the West of England Good Employment Charter, a group of responsible employers committed to good recruitment practice, equality of opportunity and fair wages.
Mayden has a good track record with respect to gender equality. 51% of our technical software and data roles are fulfilled by women, who are traditionally underrepresented. For example, 71% of our data team, 50% of our software developers and 3 of our 5 directors are women.
Regular gender pay gap monitoring helps us maintain parity when awarding a salary to new employees. Our high standards of gender equality and decreasing gender pay gap will be maintained by continuing to monitor pay, and adhering to company policy with respect to pay awards.
All salary awards are assessed against external benchmarks. During recruitment, we actively ask about salary expectation, but avoid asking about current salary. This avoids perpetuating pre-existing pay differentials in the industry.
We established a 'Diversitech' fund to provide financial support to under-represented groups, to access and complete technical training courses. Growing Mayden means we can look to grow this fund.Wellbeing
iaptus supports and empowers clinicians whilst improving outcomes for patients. We take seriously our role in supporting mental health and wellbeing of staff, suppliers, and customers and the communities they serve. iaptus was developed to improve NHS service workflows so that care is more consistent, and clinicians can spend more time on direct clinical care, benefitting clinicians, patients, and the NHS.
iaptus features support therapists to manage workload, supporting workforce wellbeing through improved efficiency and effectiveness. iaptus is used by NHS staff wellbeing hubs set up to support NHS and social care staff with their mental health.
Customers are involved in developing iaptus via user groups; engagement in an online, interactive platform capturing customer feedback, and the codesign of projects, dashboards, and features.
We play a pivotal role in the Talking Therapies community, running conferences and user groups bringing together clinicians, academics, and industry leaders to share best practice, and generate ideas for achieving the best mental health support.
Our commitment to improving mental health and wellbeing extends to the workplace, offering several initiatives that support health and wellbeing such as externally accredited Mental Health First Aiders (MHFAs); MH Boxes containing resources/tools to alleviate the onset of symptoms in the office; a “stress board”, that raises awareness, and encourages dialogue; and “tea and talk” sessions where colleagues can discuss mental health.
MINDFUL EMPLOYER Plus, available exclusively to organisations who are a signatory to the Charter for Employers who are Positive About Mental Health, offers access to impartial, confidential advice from qualified counsellors 24 hours a day, 365 days a year. Permanent employees have access to a virtual GP, mental health support, healthchecks, nutritionist consultation, expert second medical opinions, and personalised online fitness programmes, and may join the Mayden health insurance scheme.
Pricing
- Price
- £150.80 to £752.00 a licence a year
- Discount for educational organisations
- No
- Free trial available
- No