xWave Technologies

xWave CDS

xWave CDS is a cloud Clinical Decision Support and diagnostic workflow platform that helps referrers choose the best test first, automates vetting and protocolling, extracts structured clinical data and provides operational analytics. Supports radiology (iRefer), pathology, cardiology, endoscopy and physiological sciences. AWS-hosted, API-integrated.

Features

• iRefer-powered CDS for radiology, configurable to other specialties
• No-click, real-time CDS for referrers
• Smart vetting and protocolling for diagnostic teams
• NLP/LLM structured data extraction and audit
• Real-time analytics and operational dashboards
• Guideline Editor for local rules and protocol authoring
• HL7/FHIR, CDS Hooks and RESTful API integration
• Bi-directional RIS/PACS and LIMS integration
• Cloud multi-site SaaS (AWS UK/EU) with tenant isolation.
• Web, iOS, Android apps and sandbox/test environment.

Benefits

• Ensures best-test-first decisions — improved diagnostic safety.
• Reduces unnecessary imaging and healthcare costs.
• Lowers administrative workload for vetting and protocolling.
• Improves referrer experience via embedded point-of-care guidance.
• Reduces patient radiation exposure through appropriate test selection.
• Full auditable referral and vetting trails for governance.
• Real-time insights to manage capacity, waiting lists and demand.
• Configurable for local pathways and scalable across specialties.
• Supports regional network deployment and hub-and-spoke models.
• Enables guideline compliance audits and service performance reporting.

• Education pricing available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at hello@xwave.ie. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

493539043531585

Contact

Mitchell O'Gorman
+353876933364
hello@xwave.ie

About your service

• Service categories:

  Application Development and Deployment

  AI platforms

  AI software services

  • Conversational AI Software Services
  • Generative AI Software Services
  • Document AI Software Services
  • Personalize AI Software Services
  • Forecast AI Software Services
• Multi cloud support: Yes

Service scope

• Software add-on or extension: No
• Cloud deployment model: Hybrid cloud
• Service constraints: Planned maintenance scheduled outside peak hours with notice. Performance depends on customer network and access to third-party systems (EHR, RIS, PACS, LIMS). xWave minimises unplanned interruptions and coordinates change windows with clients
• System requirements:
  • Modern browser on desktop, tablet or mobile
  • Native iOS and Android apps supported; enterprise deployment options available
  • Secure internet connection required (HTTPS/TLS 1.2+) and stable bandwidth available
  • Firewall rules permitting access to designated xWave service URLs required
  • Support for HL7, FHIR, CDS Hooks and RESTful API integrations
  • Customer identity provider integration (SSO) via SAML/OAuth2 is strongly recommended
  • Device security requirements: antivirus, OS updates, MFA enabled on endpoints
  • Sufficient network bandwidth and low latency for real-time CDS responses

User support

• Email or online ticketing support: Yes
• Support response times: Target: response within 2 hours for emailed/ticketed requests during core support hours.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: EN 301 549
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: Yes
• Web chat support availability: 24 hours, 7 days a week
• Web chat support accessibility standard: EN 301 549
• Web chat accessibility testing: Intercom Messenger and our Fin AI assistant “Gina” are part of the product UI and included in our UAT and accessibility programme. Testing covered keyboard navigation, screen readers (NVDA, VoiceOver), speech recognition, high-contrast/zoom and mobile. Help articles and Fin AI replies were validated for plain-English clarity and predictable DOM focus so screen readers present content correctly. Clinical and accessibility reviewers ran sandbox UAT; issues were logged, prioritised and fixed before release. The widget is configured with ARIA roles, logical tab order and visible focus styles, and falls back to a human agent when automation is insufficient.
• Onsite support: Yes
• Support levels: XWave provides tiered support and SLAs across four severity levels (P1–P4).; P1 (Level 1 — Urgent/critical): complete outage or severe failure with no workaround. Phone support 24/7. Response target within 2 hours (24/7). Resolution target within 8 hours (95% target).; P2 (Level 2 — High): major degradation; workaround available. Phone support 09:00–17:00 Mon–Fri. Response target 4 hours (business hours). Resolution target 24 hours (95% target).; P3 (Level 3 — Routine): reduced functionality; core tasks possible. Phone support 09:00–17:00 Mon–Fri. Response target 8 hours (business hours). Resolution target 30 working days (95% target).; P4 (Level 4 — Minor/enhancement): advisory or enhancement. Response 120 hours; resolution by agreement.; ; General: Email/ticket triage target 2 hours during core business hours for non-P1 items. Service availability guaranteed 99.9% monthly (exclusions: planned maintenance, customer/third-party failures, force majeure). Remedies for SLA breaches are pro-rated service credits per the Master SLA formula. Support channels: phone, email, Intercom/in-app ticketing, web chat; dedicated Client Manager and onsite assistance by agreement.
• Support available to third parties: Yes
• AI chatbot: Yes

Onboarding and offboarding

• Getting started: Dedicated client manager leads a six-phase implementation: scoping, design & planning, configuration & build, testing & validation, go-live with real-time support, and post-implementation review. Pilot or phased roll-out and train-the-trainer options available.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: XWave facilitates extraction of customer data in agreed formats (CSV, ODF, JSON, XML) via UI or API. Transition planning provided to ensure continuity of patient care.
• End-of-contract process: Termination by written notice. Default data retention 45 days for extraction; service decommission after confirmed data transfer or secure deletion. Offboarding includes a feedback workshop; standard offboarding has no charge.
• Documentation accessibility standard: EN 301 549

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
  • Other
• Application to install: Yes
• Compatible operating systems:
  • Android
  • IOS
  • Linux or Unix
  • MacOS
  • Windows
  • ChromeOS
  • Other
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Designed for mobile. Native iOS and Android apps provide push notifications and mobile-optimised workflows
• Service interface: Yes
• User support accessibility: EN 301 549
• Description of service interface: Primary interface: secure web and mobile applications. Administration via web UI and APIs.
• Accessibility standards: EN 301 549
• Accessibility testing: We include the interface in our standard UAT and accessibility programme. Testing covered keyboard-only navigation, screen readers (NVDA, VoiceOver and JAWS), speech recognition, high-contrast/zoom scenarios and mobile accessibility. Clinical and accessibility reviewers ran sandbox UAT; we also make the UAT environment available to external testers on request. We validated help articles and automated replies for plain English clarity, predictable DOM focus and ARIA roles so screen readers present content correctly. Intercom’s widget was configured with logical tab order, visible focus styles and accessible ARIA attributes; a human-agent fallback is provided where automation is insufficient. All issues were logged, prioritised and remediated before release; results and remediation records are maintained in our UAT and accessibility logs and can be provided as evidence.
• API: Yes
• What users can and can't do using the API: Users can provision and configure their organisation via secure RESTful APIs (OAuth2.0) in sandbox and production: create organisations, departments, users and roles, register integration endpoints and onboard EHR/order-comms (FHIR/HL7). Authenticated clients can create/read/update referrals, submit vetting/protocolling actions, push/pull orders/results, export data and query analytics. Configuration changes (field mappings, workflow flags, integration settings) are permitted for authorised roles and are fully audited. Limitations: guideline authoring/publishing is via the web Guideline Editor; bulk-destructive or patient-deletion operations need contractual approval; elevated admin actions require 2FA and TAM/CSM sign-off; APIs enforce rate limits, payload limits and staged testing for production changes.
• API documentation: Yes
• API documentation formats: Open API (also known as Swagger)
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Buyers can customise departments, services and user roles; information fields and forms; referral workflows and decision-rules; local guidelines and protocols via the Guideline Editor; integration mappings (HL7/FHIR) and automated vetting rules; dashboards and report fields. Customisation is performed through the admin web UI (Guideline Editor, admin console) and programmatically via secure APIs in sandbox then production. Only authorised admin roles (organisational admins, delegated managers) can make changes; for major guideline or workflow changes we recommend coordination with the Client Success Manager or TAM. All customisations are auditable, support staged testing, and require elevated roles or CSM/TAM sign-off for production deployment.

Scaling

• Independence of resources: Multi-tenant AWS architecture with logical separation between customers. Autoscaling, load balancing and automated infrastructure management provide elastic capacity. Production environment managed by Deloitte to ensure operational scalability and resilience.

Analytics

• Service usage metrics: Yes
• Metrics types: Real-time and historical metrics: number/type of referrals, referral stage (requested → vetted → booked → completed → reported), test utilisation, waiting times, guideline adherence and compliance/audit metrics, workforce utilisation. CDS-specific measures include appropriateness scores (best-test-first rate), automated referral grading/triage, cost-avoidance estimates, conversion rates (referral → booked → completed), no-show rates, turnaround times and safety indicators. Metrics can be sliced by specialty, site, referrer, department and timeframe. Reporting: configurable dashboards, custom KPI creation, scheduled exports/reports, threshold alerts, benchmarking and trend analysis, plus API access and CSV/JSON exports for downstream analysis.
• Reporting types: Real-time dashboards
• Resource tagging: Yes
• FOCUS resource tagging: Yes

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Encryption of all physical media
  • Other
• Other data at rest protection approach: XWave relies on AWS datacentre physical controls (ISO/IEC 27001 / CSA CCM guidance) and Deloitte-managed production controls. All data at rest is encrypted using AWS-managed encryption (EBS, RDS, S3) with keys in AWS KMS, including backups and replicas. Key management, rotation and access are enforced by least-privilege IAM roles and audited admin workflows. Secure sanitisation/overwrite and controlled media disposal processes are used for decommissioned resources. Logical protections (access control, logging and monitoring) complement physical and encryption controls.
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Data Erasure
  • Explicit overwriting of storage before reallocation / Secure Erase

Data importing and exporting

• Data export approach: Exports available at user, department and organisation levels via application UI, API or by request. Exports respect role-based permissions and support scheduled, ad-hoc and bulk exports.
• Data export formats:
  • CSV
  • ODF
  • Other
• Other data export formats:
  • JSON
  • XML
• Data import formats:
  • CSV
  • ODF
  • Other
• Other data import formats:
  • JSON
  • XML

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • Private network or public sector network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • Other
• Other protection within supplier network: Within our network all service-to-service and internal API traffic is protected using TLS 1.2+ (internal HTTPS / mutual TLS patterns where required). We enforce strict network segmentation using AWS VPCs, Security Groups and Network Firewalls, and use VPC Endpoints / PrivateLink for private service connections. Sensitive internal channels (S3, RDS, queues) use encrypted links and AWS-managed keys. All internal traffic is monitored and logged (CloudWatch/GuardDuty) and access is governed by least-privilege roles and audited admin workflows.

Availability and resilience

• Guaranteed availability: XWave guarantees 99.9% monthly availability for xWave CDS, supported by AWS multi-AZ hosting, autoscaling and managed operations; availability is monitored continuously and incidents must be reported through agreed support channels. If we breach the SLA we provide pro-rated service credits (calculated quarterly under the Master SLA formula) and customers may cancel with 30 days’ notice; planned maintenance, customer/third-party failures and force majeure are excluded from SLA calculations.
• Approach to resilience: XWave CDS is architected for resilience: AWS multi-AZ deployments, autoscaling, logical tenant separation and separate production/UAT accounts with immutable CI/CD (ECR/CodePipeline). Data is encrypted, backed up daily and replicated; RPO <24h and RTO <4h. Production is operated under Deloitte-managed services with 24/7 monitoring (CloudWatch, GuardDuty), VPC/network segmentation, Security Groups, PrivateLink and automated health checks driving failover and scale. Regular DR exercises, automated backups, runbooks, incident playbooks and post-incident RCA are maintained. Sensitive restores/changes follow staged testing, change control and TAM/CSM approval. Detailed architecture and DR reports available on request.
• Outage reporting: Outages are handled per our SOP. Primary reporting is via Intercom (tickets create Slack messages); monitoring (AWS CloudWatch/CloudTrail/GuardDuty and Sentry for app traces) detects and times outages and triggers alerts. We send an initial client notification within 30 minutes, use in-app Intercom notices and email alerts, and phone-escalate for critical customers. The Incident Owner completes an RCA in Intercom within 72 hours; a PIR is held for all P1s and significant P2s. All communications and evidence are retained with the ticket.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Dedicated link (for example VPN)
  • Username or password
  • Other
• Other user authentication: API access uses OAuth2 tokens and scoped roles
• Access restrictions in management interfaces and support channels: Management interfaces are restricted by role-based access controls, unique admin accounts, mandatory 2FA/SSO and least-privilege principles. Privileged interfaces require a secure network (VPN/PrivateLink) or IP whitelisting and may use public-key/TLS client certificates. All admin actions are logged, audited and subject to quarterly access reviews and 6-monthly testing. Support channels (Intercom, email, phone) enforce identity verification (registered contact, support code or security questions) before sensitive changes. Third-party/supplier access is time-limited, approved via change control and audited (SSM sessions/log capture). All support interactions are recorded and attached to tickets for traceability.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Dedicated link (for example VPN)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: XWave operates an ISO-27001 aligned ISMS covering access control, cryptography, asset & supplier management, secure development, change control, vulnerability management, incident response and business continuity.; Governance: CEO (Mitchell O’Gorman) is board-level security owner; operational responsibility lies with the Risk & Compliance Officer, CTO and Lead Developer, supported by a security steering group and Deloitte for production monitoring.; Enforcement: mandatory staff training, role-based access and 2FA, formal change control, continuous monitoring, scheduled external penetration tests, vulnerability scanning, internal audits and SOPs (incident/RCA/PIR). KPIs and remediation are reviewed quarterly and escalated to the board.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: XWave uses an Infrastructure-as-Code, CI/CD-driven change process to track components and manage changes. Components are versioned (Bitbucket/ECR), deployed from templated IaC (CloudFormation/CodePipeline), and tagged (env, billing) for lifecycle tracking. Change requests include a security-impact assessment (threat review, SAST/DAST results, vulnerability scan) and are tested in UAT. A Change Authority (including Deloitte CMS for production) approves releases only after security and QA sign-off. Production deploys use automated pipelines with rollback plans and post-change validation. All changes, approvals and audit evidence are recorded in change logs, SSM documents and ticketing systems.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: XWave follows a supplier-defined vulnerability management programme aligned to recognised frameworks (ISO/IEC 27001 / CSA CCM principles). Key practices: continuous monitoring (CloudWatch/GuardDuty; app tracing), automated SAST/DAST and dependency scanning, third-party penetration tests (independent, at least annual), threat-intel and CVE monitoring, formal triage and remediation workflows, and tracked tickets with SLAed patching (routine within seven days; critical within 48 hours). Deloitte CMS supports SOC triage and escalation. Findings, remediation and KPIs are reported into the ISMS and to senior management for oversight.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: Protective monitoring is 24/7 via Deloitte CMS/SOC using CloudWatch/CloudTrail/GuardDuty and Sentry with automated rules and SIEM correlation to flag compromises. The SOC triages alerts, opens an incident and assigns an Incident Owner. Response includes containment, forensic capture, patching and customer communication. Targets: SOC triage within 1 hour, containment ~4 hours, remediation started within 24 hours and RCA within 72 hours.
• Incident management type: Supplier-defined controls
• Incident management approach: Pre-defined runbooks cover P1–P4 events. Users report incidents via Intercom (email auto-creates tickets); Slack supports real-time escalation. Deloitte CMS/SOC provides 24/7 triage and an Incident Owner is assigned. Initial client notification is sent quickly (within 30 minutes); an RCA draft is provided within 72 hours. Final reports and PIRs are delivered via Intercom and email with supporting evidence.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: Yes
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 10%
• Between £250,000 and £500,000: 12.5%
• Between £500,001 and £1,000,000: 17.5%
• Between £1,000,001 and £2,500,000: 20%
• Between £2,500,001 and £5,000,000: 22.5%
• Over £5,000,001: 25%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: SGS
• ISO/IEC 27001 accreditation date: Saturday 20 September 2025
• What the ISO/IEC 27001 doesn’t cover: The certificate covers xWave Technologies’ Information Security Management System for the design, development, delivery and support of the xWave CDS service (secure development, operations, incident management, change control, supplier management and related processes).; ; Exclusions:; ; Physical datacentre security for the AWS platform (AWS holds its own datacentre certifications).; ; Customer-managed, on-prem systems and third-party EHR/RIS/PACS installations outside xWave’s control.; ; Any scope items explicitly listed as exclusions in our Statement of Applicability (SoA) ; ; Full scope and detailed exclusions are documented in our ISO/IEC 27001 scope statement and SoA, available on request.
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: Cf306f16-83fb-4e6d-bf9d-d5e3f5c3b58f
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: Aab2b0ee-d4e9-4cb6-8552-1232e8e59aa4
• Other security certifications: Yes
• Any other security certifications: Data Security and Protection Toolkit

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
    • Understanding barriers to access to health and social care services or employment opportunities e.g. digital inclusion
    • Inclusive and accessible recruitment practices, development practices and retention policies that support-focused activities including those provided in the Guide for line managers on recruiting, managing and developing which support people with a disability or health condition
    • Actions to invest in the physical and mental health and wellbeing of the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at hello@xwave.ie. Tell them what format you need. It will help if you say what assistive technology you use.