IDOX SOFTWARE LTD

iFit and iAssets

iAssets, part of iFit platform enables tracking, retrieval and management of all equipment within the hospital and throughout the community.
Trusts can track assets using existing Wi-Fi and Bluetooth. We offer a range of technology to suit your requirements, including RFID, Wi-Fi, Bluetooth, GPS, mobile capability. We are GS1 certified.

Features

• Compatible with a range of vendor systems.
• Tracking of devices in the community via GPS.
• Deployable via RFID, Bluetooth, Wi-Fi, GPS, mobile.
• Track devices across Trust sites within the ICS.
• Geofencing to alert if items leave or enter a building.
• Data segmented for multiple department use.
• 10 standard reports including assets, history, sterilization, utilisation, status.
• Compliant with all 7 GS1 keys, aligned to Scan4Safety.
• Functionality to provide Scan4Safety data using mobile devices.
• API available for system integration.

Benefits

• Accurately track assets throughout the hospital and community.
• Improved compliance with equipment control and visibilty.
• Save NHS funds my minimising loss and increasing equipment availability.
• Improved compliance with equipment control and visibilty.
• Increased staff efficiency and productivity
• Improved budget control with evaluation of asset use.
• Optimised patient care and safety and improve morale
• Minimised loss of expensive medical equipment.
• 360 view ensures rapid delivery of equipment in an emergency.

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at bidteam@idoxgroup.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

496568323858573

Contact

Jen.roberts@idoxgroup.com
0333 011 1200
bidteam@idoxgroup.com

About your service

• Service categories:

  Applications

  Enterprise resource management

  • Asset life-cycle management
• Multi cloud support: Yes

Service scope

• Software add-on or extension: No
• Cloud deployment model: Private cloud
• Service constraints: No
• System requirements:
  • Cloud hosted, so doesn't require a local server.
  • Web based, so is available on modern browsers.

User support

• Email or online ticketing support: Yes
• Support response times: Our standard Service Desk is operational Monday to Friday during business hours (8.30 am - 5.30pm) although requests for support can be logged 24/7. Questions or requests for support are prioritised in accordance with their severity and urgency. Our SLA for support is available during the clarifications stage of G-Cloud procurement.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: None or don’t know
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: Yes
• Web chat support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support accessibility standard: None or don’t know
• How the web chat support is accessible: The customer portal is accessible via a standard web-browser (e.g. Microsoft Edge, Chrome, Firefox and Safari 6.1.5 or above), therefore browser accessibility features may be utilised.
• Web chat accessibility testing: None
• Onsite support: Yes, at extra cost
• Support levels: High priority issues such as a total system failure will be subject to a target response time of within 2 working hours of request being logged(*elapsedtime). The target resolution time is within 2 working days of request being logged(*elapsedtime). ; Medium priority issues such as an important or critical component that has failed causing a partial failure will be subject to a target response time of within 4 working hours of request being logged(*elapsedtime). The target resolution time is within 5 business days of request being logged(*elapsedtime). ; Low priority issues such as isolated faults that do not fall into the categories listed above will be subject to a target response time of within 4 working hours of request being logged(*elapsedtime). The target resolution time is within 90 business days of request being logged(*elapsedtime). ; Enquiries will be subject to a target response time of within1 working day of request being logged(*elapsedtime) and will be resolved according to best of endeavours depending on the nature of the enquiry.; *Elapsedtime refers to the duration of the request where it is with Idox Service Desk for action and does not include periods of time when the request is with the customer to action or respond.
• Support available to third parties: Yes
• AI chatbot: No

Onboarding and offboarding

• Getting started: We will support the implementation following PRINCE2 based methodology to ensure the project follows a critical path to go-live supported by manageable work packages. Our Implementation Team will be staffed by a dedicated Project Manager, Lead Consultant, Support Consultant, Application Specialist, Hosting Team and Development Support Team. Together this team has significant experience of successfully implementing iFIT at NHS Trusts throughout the UK.
• Service documentation: Yes
• Documentation formats: PDF
• End-of-contract data extraction: We will provide an “Exit Plan” should the Trust wish to terminate the contract. At all times all the data within iFIT is accessible to the Trust and can be exported without supplier input into CSV or Excel format using the various reporting / extract tools built into the service. Additionally a data extract can be made available at the end of a contract provided by one of our Data Consultants. This can be agreed prior to the contract, during or on contract termination.
• End-of-contract process: The Idox Account Manager will liaise with the customer to determine
• Documentation accessibility standard: None or don’t know
• How the documentation is accessible: Documentation is accessed a number of ways via our Hornbill customer facing portal which is WCAG compliant, or via the Idox Project Management team directly.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: IFIT is built using standard web-based technologies which means users enjoy the same experience using the application on any device running a standard web-browser. Users can therefore access the system using devices running iOS or Android using the standard browsers available on those platforms.
• Service interface: Yes
• User support accessibility: None or don’t know
• Description of service interface: There is a low-level interface directly to the database which allows iFIT to synchronise asset information with other third-party products. We have implemented this interface with the leading maintenance systems within the NHS and beyond, such as EQUIP. The interface allows systems such as EQUIP to pull asset information and provide asset information like maintenance dates, availability etc. We also have SOAP XML webservices available for certain functionality like asset tracking and "gofind", although these were built for mobile application "GoFind" they are produced as standard SOAP XML services and can be used to integrate with product on API level.
• Accessibility standards: None or don’t know
• Description of accessibility: The application is provided solely via a web browser interface, therefore standard browser provided accessibility features are available for those with vision, learning, physical or other impairments (e.g. keyboard shortcuts, increasing font sizes, zooming, page colour / font overrides). However there may be some components of the solution that do not dully meet WCAG accessibility levels.
• Accessibility testing: N/A
• API: Yes
• What users can and can't do using the API: IFIT is provided with an API as part of the Annual Support and Maintenance subscription agreement, enabling straight-forward integration and data transfer between compatible systems including those provided by third parties. These integrations usually ensure that the integration is minimally noticeable to the system users at a technical level, with the integration adopting consistent system workflows and UX features where applicable. It is also worth noting that these APIs are intended to help make the interaction within evolving ICT environments more efficient and user-friendly and when used, they will ensure that the Trust remains compatible with the current and future integration requirements. Our approach to API integration starts with understanding the requirement (e.g. what {{customer_short_name}} is seeking to achieve). Once we have this understanding, we will recommend which API should be used. We have HL7 interfaces through Mirth, SOAP based XML interfaces, and in some case direct database interfaces (where performance is key).; ; We have experience of several interfaces particularly relating to tracking technology for BLE, GPS based, and RFID. Furthermore, our footprint of supported APIs grows year on year as the technology evolves.
• API documentation: Yes
• API documentation formats: PDF
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: All reference data such as service levels, property codes and activity categories.; Web look and feel; Labels, wording and terminology; Reference data (such as group codes, SLAs, asset types, building categorisation); Workflow – to reflect customer business processes and escalation procedures

Scaling

• Independence of resources: Customers are in isolated environments with dedicated resources.

Analytics

• Service usage metrics: Yes
• Metrics types: Service usage and availability metrics are available on request.
• Reporting types: Regular reports
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest:
  • Encryption of all physical media
  • Other
• Other data at rest protection approach: Data is encrypted at rest using a minimum of AES-256 encryption.
• Data sanitisation process: Yes
• Equipment disposal approach: A third-party destruction service
• Data sanitisation type: Explicit overwriting of storage before reallocation / Secure Erase

Data importing and exporting

• Data export approach: At all times all the data within iFIT is accessible to the Trust and can be exported without supplier input into CSV or Excel format using the various reporting / extract tools built into the service.
• Data export formats: CSV
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • TLS (version 1.2 or above)
  • Other
• Other protection between networks: VPN connection is available
• Data protection within supplier network:
  • TLS (version 1.2 or above)
  • Other
• Other protection within supplier network: Data is encrypted at rest with AES-256GCM.

Availability and resilience

• Guaranteed availability: Application availability will be 98.5% in working hours (9.00-17.00 Monday-Friday excluding Bank Holidays) and 96% out of working hours excluding scheduled maintenance windows and planned downtime.
• Approach to resilience: Our hosting platform is designed for high availability and reliability. The environment operates on an N+1 architecture where redundancy is available at all levels from data centre services through hardware and virtualisation platforms and to load balanced servers. This means that most failures can be handled with no interruption to service.; ; The solution is designed to provide high availability across business hours, with planned maintenance windows outside of those. In the event of an unrecoverable event causing the primary datacentre to become unusable an alternate redundant site is available to stand up service.
• Outage reporting: All communication in the event of an availability incident will be to the Trust's nominated contacts via our Service Desk. Updates will be communicated via the customer portal, email or phone depending on the priority level of the incident.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Username or password
  • Other
• Other user authentication: Authentication is based on either Microsoft SQL Server native account security or integrated Active Directory authentication. This means that if the user accounts are setup with Microsoft SQL Server then effectively the database server will authenticate the user when logging on, alternatively the Microsoft SQL Server can integrate with Active Directory meaning users can seamless logon using a trusted Active Directory. However in practice, this second option is rarely used as it would mean {{customer_short_name}} creating a trusted share to the cloud environment for their active directory and generally is used only for on-premise versions of the application
• Access restrictions in management interfaces and support channels: The application has a sophisticated role management system underpinning the screens, functions and modules. This means that super users or admins can create permission sets for users and groups of users and restrict access to parts of the application including the management tools and admin screens. The user interface for managing these permissions are clear and easy to understand ensuring the admin has full control and visibility of what has been granted and to whom.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Other
• Description of management access authentication: Access is via a VPN using 2FA using accounts that are administration accounts which are separate from corporate accounts. Access is restricted to approved staff with any other access subject to change control and supervision.

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: We recognise that information security important in the development and implementation of all systems delivered to our customers, to Idox as a corporate entity, and to our supply chain.; ; To ensure a consistent and effective approach, we operate an externally audited and certified, organisation wide Information Security Management System (ISMS) which implements and enforces controls on all business functions covering but not limited to information systems, networks, physical environment, incident/threat management, project and contract management and personnel management. ; ; Our systems and controls are also externally verified and certified annually as part of the ISO 27001 certification process. Risks raised through internal and external audits are reviewed at management meetings by the Information Security Manager, the appropriate Head of Business and a board representative.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: All changes to the service are carried out using change requests and are maintained within the change management system. The change management process incorporates a business case / justification for the change, a backout plan, and a final approval with scheduling for the change to be implemented. They will be assessed for security or service impacts during this process, before deployment to a separate QA environment where they are checked for verification before release to production.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: We monitor OWASP and various vendor alert sources for emerging vulnerability intelligence and patching data. A combination of web application scanning, host vulnerability scanning, and external perimeter proactively identifies any design, configuration, or patching weaknesses. When identified, any threats are assessed in context and where warranted, mitigations are implemented in accordance with their severity. These controls and processes are monitored as part of our ongoing ISMS/ISO27001 auditing programme.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: Monitoring tools are used to measure server performance metrics as well as storage and network / bandwidth utilisation and unusual server / network / perimeter activity. Alerts from these systems are actively monitored and reviewed and any potential intrusion attempt is raised in line with our security incident reporting procedure for further investigation.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: Our incident management process is central to ISO27001 Information Security Management System(ISMS). In line with Incident Management Policy and Process, incidents are raised to the Service-desk or detected by monitoring such as SIEM, triaged and escalated as required. All tickets are allocated a reference number and tracked to conclusion. Results are monitored, documented and preventative action taken to prevent re-occurrence. The incident-team maintain contact with relevant internal and external stakeholders within predefined timeframes. For GDPR related incidents this is 24-hours from confirmation.; Security incidents raised to the internal incident register are subject to regular reviews by the senior team.
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 0%
• Between £2,500,001 and £5,000,000: 0%
• Over £5,000,001: 0%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: Citation ISO Certification Limited
• ISO/IEC 27001 accreditation date: Monday 27 May 2024
• What the ISO/IEC 27001 doesn’t cover: Our ISMS is certified and tested to ISO27001 standards annually and covers our entire organisation.
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• Who accredited the ISO 9001 certification: Citation ISO Certification Limited
• ISO 9001 accreditation date: Thursday 11 April 2024
• What the ISO 9001 doesn’t cover: Our ISMS is certified and tested to ISO9001standards annually and covers our entire organisation.
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 5c6de739-c45d-4eee-916a-013a0c2ce8f7
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: 26018f8f-da19-4856-8fd2-b719e0c21047
• Other security certifications: Yes
• Any other security certifications: ISO 22301

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
    • Monitoring and reporting of gender and ethnicity pay gaps and plans to address them where necessary

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at bidteam@idoxgroup.com. Tell them what format you need. It will help if you say what assistive technology you use.