Decently

Melo

Melo is a digital platform built in collaboration with NHS Trusts and clinical experts which helps make behavioural data more accessible and actionable for clinical teams looking after patients with neurological conditions.

Features

• Clinical behavioural assessment forms
• Real-time patient reporting
• Dynamic risk levels and tracking
• Accessible across all devices and modern browsers
• Meets DTAC security standards
• Digital audit trail of patient assessments
• Replaces the need for paper-based assessments and reporting

Benefits

• Standardised collection of clinical data
• Improves clinical decision making
• Allows users to prioritise resources and interventions
• Can be used on mobile, tablet and desktop
• All patient data is secured to current NHS standards
• Provides a legal record of all behavioural assessments
• Saves time for busy clinicians

£5,000 to £50,000 a licence a year

• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at jc@decently.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 14

Service ID

524051914503601

Contact

James Chapman
07555401212
jc@decently.co.uk

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: Users will be informed in advance of any scheduled service downtime. This is scheduled for times when service usage is at a minimum.; The service is delivered as a hosted, cloud-based software as a service model with no local hardware or software requirements other than a functioning, compatible web browser. We use Azure Services hosting platform which has very high resilience and reliability with 99.5% guaranteed uptime. Redundancy is provided in the platform and managed by the host to eliminate the effects of technical hardware failure.
• System requirements:
  • Modern browers inc. Chrome, Microsoft Edge
  • Internet connection
  • Modern mobile & tablet devices

User support

• Email or online ticketing support: Email or online ticketing
• Support response times: Initial response within 1-2 business days
• User can manage status and priority of support tickets: No
• Phone support: No
• Web chat support: No
• Onsite support: No
• Support levels: Decently offers our standard level of support available as part of the licence fee.; ; All customers will have access to their account manager and the Decently support helpdesk.; ; Business Hours: 09:00 to 17:00 (Monday-Friday, not including UK Bank holidays); Support Email: support@decently.co.uk; Emails received outside of these hours will be viewed and assessed the next available business day.; ; More detail available in the full Support SLA contained within the attached Service Definition document
• Support available to third parties: No

Onboarding and offboarding

• Getting started: We will provide online training (onsite if necessary) to the initial group of admins and super users in a "train the trainer model". In addition we will provide quick reference help guide and access to support help desk.; ; From here the Admins and Super users will set up subsequent users and conduct the training
• Service documentation: No
• End-of-contract data extraction: In the event of Melo licence not being renewed, repatriation of data will be discussed between Melo Admin and Melo support team at Decently.
• End-of-contract process: In the event of Melo licence not being renewed, removal of access to the system will be discussed between Melo Admin and Melo support team at Decently.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Chrome
  • Safari
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Functionality across screensizes is identical. The only differences are UI layouts which in some areas involves progressive disclosure of less common functionality e.g. demoting non-essential content into sub-menus.
• Service interface: Yes
• User support accessibility: WCAG 2.1 AA or EN 301 549
• Description of service interface: Web based interface accessed through a modern browser on phones and on screen.
• Accessibility standards: WCAG 2.1 AA or EN 301 549
• Accessibility testing: None
• API: No
• Customisation available: No

Scaling

• Independence of resources: Melo is hosted on Azure with the ability to scale to meet demand quickly. We follow good design and development practices with built-in testing. We undertake regular performance testing on our environments.

Analytics

• Service usage metrics: Yes
• Metrics types: User access and usage metrics will be provided through the dashboards available to the Admin user. Reasonable requests for additional metrics may be requested from the support team as bespoke exports - these will be responded to on a "best endeavours".
• Reporting types:
  • Real-time dashboards
  • Reports on request

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Up to Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 3.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a Tigerscheme qualified provider or a CREST-approved service provider
• Protecting data at rest:
  • Encryption of all physical media
  • Other
• Other data at rest protection approach: All data within the Azure environment is encrypted. Melo uses Azure Postgresql as a back-end relational database. Azure Postgresql information is encrypted at rest (FIPS 140-2). ; ; More info here: https://learn.microsoft.com/en-us/azure/postgresql/single-server/concepts-security; ; We use Azure to host Melo. Please see information relating to Microsoft's physical security here: ; ; https://learn.microsoft.com/en-us/azure/security/fundamentals/physical-security
• Data sanitisation process: No
• Equipment disposal approach: A third-party destruction service

Data importing and exporting

• Data export approach: Decently support team will do this on their behalf
• Data export formats: CSV
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: We use Azure Services hosting platform which has very high resilience and reliability with 99.5% guaranteed uptime. Redundancy is provided in the platform and managed by the host to eliminate the effects of technical hardware failure.
• Approach to resilience: Available on request
• Outage reporting: Email and in-house messaging alerts when production servers meet a threshold. After initial investigation by the technical team users and customers are informed as required by the situation.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • 2-factor authentication
  • Username or password
• Access restrictions in management interfaces and support channels: We use cloud services to host and support the Melo application and we don't have an internal network. ; ; All cloud accounts have MFA and strong passwords. Where possible admin accounts and standard accounts are separate, users with access to cloud apps have the least privilege access and super user/admin accounts are not used for daily "normal" activity. We use VPN software with a dedicated fixed IP to reduce the risk of a cyber event.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • 2-factor authentication
  • Username or password

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Standards and certifications

• ISO/IEC 27001 certification: No
• ISO 28000:2007 certification: No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Cyber essentials plus: No
• Other security certifications: Yes
• Any other security certifications:
  • NHS DSP Toolkit
  • NHS DTAC
  • ORCHA Baseline Assessment

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: Other
• Other security governance standards: NHS DTAC
• Information security policies and processes: Our information security policies align to guidance detailed in the NHS DTAC assessment; ; DTAC is focused on 5 core areas. Sections 1 to 4 form the assessed criteria, with a separate conformity rating provided around usability and accessibility:; ; 1. Clinical safety; Products are assessed to ensure that clinical safety measures are in place and that organisations undertake clinical risk management activities to manage this risk.; ; 2. Data protection; Aligned to GDPR requirements, our products are assessed to ensure that data protection and privacy is ‘by design’ and the rights of individuals are protected.; ; 3. Technical assurance; Products are assessed to ensure that products are secure and stable.; ; 4. Interoperability; Products are assessed to ensure that data is communicated accurately and quickly whilst staying safe and secure.; ; 5. Usability and accessibility; Products are allocated a conformity rating having been benchmarked against good practice and the NHS service standard.; ; The DTAC includes company information and value proposition sections for context. Each of the scored and assessed sections contain:; ; a reference code for each question; the question for the developer to respond to; whether evidence is required and is so the evidence; response options or free text; supporting information and guidance; scoring criteria

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Following a security development approach that encompasses OWASP considerations in addition to basic clinical safety checklists at the design and development stages. We have Test, Pre-Prod and Production environments. ; ; Changes to production environment settings and configurations have to be signed off by a director before committing to changes. Changes are logged (via Azure and via internal Slack Channel).
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: Internally we have Cyber Essentials and follow patching and access control and virus scanning guidance.; ; Our code base is scanned for third-party library vulnerabilities. We undertake code reviews and undergo an annual OWASP pen test.; ; If a vulnerability is identified as an immediate threat this would be prioritised. We are able to deploy patches/bug fixes to our service within a very short time frame. ; ; We use Azure Defender for Cloud to monitor threats.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: We monitor our Azure environment using Defender for Cloud. Activity within our production environment is logged. Where a threat is high risk we can respond to serious incidents the same working day.
• Incident management type: Supplier-defined controls
• Incident management approach: We have an inhouse Data Protection Officer (James Burch) and an external DPO from a Cyber Security and Compliance specialist NaqCyber.com; ; In addition through our Cyber insurance with CFC (market leading Cyber insurance specialists) we have a managed incident response plan in place.; ; Our systems and policies covering GDPR and Data Security are in place should there be any form of incident involving users or customer data.; ; Users can report an incident through our support helpdesk (see attached Service Definition document) and the resolution time / incident reports will depend on the nature of the incident.

Secure development

• Approach to secure software development best practice: Supplier-defined process

Public sector networks

• Connection to public sector networks: No

Social Value

• Social Value:

  Social Value

  • Fighting climate change
  • Covid-19 recovery
  • Wellbeing

  Fighting climate change

  The implementation of Melo directly links to a tangible reduction of paper-based clinical assessments, in one hospital setting was estimated to be at least 30,000 sheets of paper per year

  Covid-19 recovery

  Melo implementation helping with the digital transformation strategy across UK Health care system that was under scrutiny during covid, ain particular improved staff IT literacy and is vital the momentum is continued as part of recovery and lessons learned

  Wellbeing

  Melo aims to directly improve patient and staff wellbeing through increased understanding of patient behaviour

Pricing

• Price: £5,000 to £50,000 a licence a year
• Discount for educational organisations: No
• Free trial available: Yes
• Description of free trial: One months free trial, limited to; ; - 30 assessments; - base version / functionality (as is); - one ward/unit; - 5 users

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at jc@decently.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.