IMOSPHERE LTD

EHCP Genie (part of the SEND Genie Toolkit)

EHCP Genie uses AI to draft, quality assure and redraft EHCPs quickly, including for annual reviews and phase transfers, improving consistency and evidencing the Golden Thread.
EHCP Genie is part of the SEND Genie Toolkit, which also includes SEND Funding Genie (listed separately).

Features

• EHCP AI-supported drafting for new plans using council's own templates
• EHCP AI-supported re-drafting for reviews and phase transfers
• EHCP quality assurance for SMART outcomes and golden thread
• EHCP quality assurance for provision specificity and missing/contradictory data
• Data stored in UK; AI processing in memory; minimal retention
• AI-supported funding/banding functionality available in same platform (separate G-cloud listing)

Benefits

• Faster EHCP drafting to meet the 20-week measure more often
• Higher quality EHCPs with stronger links between needs/outcomes/provisions
• Improvements to existing EHCPs through QA and AI-supported re-drafting
• Significant admin time saved through automating first draft and QA
• Rapid deployment with phased launch and online learning for teams
• Data protection reassurance for DPOs and inspection readiness

• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at info@imosphere.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

524495078472698

Contact

Oliver Brown
0800 802 1884
info@imosphere.co.uk

About your service

• Service categories:

  Applications

  Production and operations

  Service industry and public sector operations

  • Education
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: There is a brief monthly maintenance window which is timed to be outside of UK core office hours.
• System requirements:
  • Web-based access; no local installation required
  • Modern web browser with JavaScript and cookies enabled
  • Reliable internet connection over HTTPS
  • Role-based user accounts managed by the local authority
  • Two-factor authentication mandated
  • Software to open/view DOCX and PDF export files
  • Email access for account invitations and notifications

User support

• Email or online ticketing support: Yes
• Support response times: Core support hours: Mon–Fri 09:00–17:30 UK time (excluding bank holidays). Response targets: Priority 1 (service unavailable) notify key contacts within 1 hour of awareness, restore within 24 hours, permanent fix within 5 working days. Priority 2 initial response within 4 support hours; workaround within 2 working days; permanent fix within 7 working days. Priority 3 initial response within 1 working day; cause within 10 working days; action within 15 working days. Priority 4 initial response within 3 working days. Out of hours/weekends: tickets are logged and triaged next business day; Priority 1 incidents are escalated immediately.
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: No
• Support levels: We provide a service desk ticket system and email support 09:00–17:30 UK time, Monday–Friday, excluding bank holidays. SLA targets: P1 service outage notify key contacts within 1 hour, restore within 24 hours; P2 initial response 4 support hours; P3 1 working day; P4 3 working days. Weekend/out‑of‑hours tickets are logged and triaged next business day; P1 incidents are escalated immediately.; ; This does not come at an extra cost but is included in the annual contract fees - which also includes regular software updates, remote check‑ins with customer success team, online training resources and attendance at customer events.; ; Any extended hours cover required by customers and any training/workshops or configuration/modelling assistance not included in the annual contract fee are priced at our published G‑Cloud day rates ; ; A named Project Manager and Customer Success Consultant is provided during implementation, with the named Customer Success Consultant continuing for BAU for the lifetime of the contract.; ; We can participate in local authority change boards and steering groups on request.
• Support available to third parties: No

Onboarding and offboarding

• Getting started: Our primary software onboarding approach is through online training videos.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: This is not applicable for EHCP Genie as the outputs of the software are auto-generated documents which are downloaded at the time - and automatically removed from the software's database shortly afterwards.
• End-of-contract process: Having agreed the end point of the contract, we would disable all access to the software and securely destroy data held on our systems in line with our data sanitisation processes - with the exception of any data to be retained as per our Data Retention Policy. We retain financial information regarding our relationship for the period required by HMRC.; The above is all included in the price of the contract.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Chrome
• Application to install: No
• Designed for use on mobile devices: No
• Service interface: Yes
• User support accessibility: WCAG 2.2 AA
• Description of service interface: Browser-based user interface. Users log in to upload documents containing information for the AI to use to generate draft EHCPs and/or QA reports for EHCPs in DOCX format. No local installation. Accessed over HTTPS. Data stored in the UK.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: Not yet completed
• API: No
• Customisation available: Yes
• Description of customisation: EHCP Genie customisation includes use of own local EHCP template within the software and support for customised AI prompting to influence the style and language used in AI-generated EHCP content.; The customisations above are managed by Imosphere by request from the council.

Scaling

• Independence of resources: The service is multi-tenant with logical isolation per council. Imogen AI calls are brokered through an orchestration queue that enforces per-tenant rate limits and back-pressure. We monitor Azure endpoint quotas (tokens and requests per minute) and schedule work accordingly. Large documents are chunked and processed in parallel with safe retries and circuit breakers.

Analytics

• Service usage metrics: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Physical access control, complying with another standard
  • Encryption of all physical media
  • Scale, obfuscating techniques, or data storage sharding
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type: Data Erasure

Data importing and exporting

• Data export approach: This is not applicable for EHCP Genie as the outputs of the software are auto-generated DOCX documents which are downloaded at the time - and automatically removed from the software's database shortly afterwards.
• Data export formats: Other
• Other data export formats: N/A
• Data import formats: Other
• Other data import formats:
  • PDF
  • ODT
  • TXT

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • Private network or public sector network
  • TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: We guarantee 99.99% application availability, measured on a monthly basis, excluding planned maintenance and force majeure events. The service is hosted on resilient infrastructure with continuous monitoring. Availability is tracked at application level and reviewed monthly. If monthly availability falls below the guaranteed level, customers are entitled to a service credit equivalent to one day’s service for each full day in which the availability guarantee is breached, calculated on a pro-rata basis. Service credits are applied as a credit against future invoices or as additional service time at no charge, at our discretion. To request a service credit, customers must notify us within the relevant billing period, providing details of the dates of the service breach. All requests are validated against our service availability monitoring data.; The total service credit applied in any month will not exceed 100% of the monthly service charge for the affected service.
• Approach to resilience: Information is available on request.
• Outage reporting: Outage reports and notifications of planned work that may affect services are available via a public dashboard. Detailed information, including where individual customers may be affected, is provided via email alerts.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password
• Access restrictions in management interfaces and support channels: Only users assigned 'Management' or 'Administrator' permissions can access management interfaces - and these levels are reserved solely for Imosphere employees.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: We operate an Information Security Management System (ISMS) certified to ISO 27001:2022, supported by a comprehensive suite of policies covering areas such as employee screening and training, record classification and retention, information risk management, change management, incident management, business continuity, supplier management, network and access control, cryptographic controls, pseudonymisation and de-identification, and physical security.; Information security is overseen by our COO, who also serves as Chief Information Security Officer (CISO) and reports directly to the CEO. We also have a named Data Protection Officer. Day-to-day operation of technical and organisational controls is carried out by our Information Security Officer, IT Manager and CTO, with defined escalation routes for risks, incidents and non-conformities.; We ensure policies are followed through mandatory annual training for all employees, role-specific training for privileged users, internal audits, continuous monitoring of key controls, regular access reviews, supplier assessments, and structured incident reporting that is reviewed in monthly meetings.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: We have a documented configuration and change management policy.; We track the hardware components of our solutions via an asset management database.; Our change management process includes testing and review prior to implementation.; All software changes go through our full software development lifecycle, including quality gateways, multiple forms of testing (automated, security, UAT, requirements etc) and release management processes.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: We follow a documented vulnerability management policy. Routine updates are deployed on a monthly scheduled basis following testing in a lab environment with maximum timeline of 10 working days. Emergency updates are deployed following our emergency change process with a maximum timeline of 2 working days. Multiple sources are used for information: independent security organisations (i.e. BugTraq, Full Disclosure), vendors, government (e.g. NCSC, NIST), published information from security organisations and professionals and security conferences.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: We have a documented Information security event management policy. We use a SIEM tool to monitor activity on both compute and network devices with automated rules to highlight suspicious activity.; Potential compromises are raised within our Information Security Team messaging channel, and response is agreed depending on the severity. These are logged in our IS Issues Log.
• Incident management type: Supplier-defined controls
• Incident management approach: Our incident management process is based on the ITIL approach and includes consideration of prioritisation, proportionate response, monitoring, escalation and retrospective review. All employees are trained on the incident reporting and management approach. Senior management monitor issues in aggregate and on specific escalated issues, including performance against internal and external SLA standards.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: Yes
• Description of free trial: We provide a 2-week free trial for local authorities in England. This is a fully-featured trial - except that uploading EHCPs and other written documents containing identifying information about real individuals in not permitted. Instead, sample documents or redacted real documents must be uploaded.

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 0%
• Between £2,500,001 and £5,000,000: 0%
• Over £5,000,001: 0%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: LRQA
• ISO/IEC 27001 accreditation date: Wednesday 22 January 2025
• What the ISO/IEC 27001 doesn’t cover: N/A
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 654ac91f-1265-4ec9-aaea-35e2f4ea8eae
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: 5491d37d-36d8-4d68-a9a4-5bf7e390de55
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Plans to engage the contract workforce in deciding the most important workplace issues to address
    • Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
    • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
    • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
    • Offer a pay and leave entitlement to all eligible staff who become kinship carers, ideally equivalent to statutory adoption pay and leave
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Monitoring and reporting of gender and ethnicity pay gaps and plans to address them where necessary
    • Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible
    • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications
    • Volunteering opportunities for staff

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

    • Activities to identify opportunities to open up sub-contracts under the prime contract to a diverse range of businesses, including new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutuals
    • Measures to involve local stakeholders and/or users in design (e.g. in the design of services, systems, products or buildings)

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
    • Actions to invest in the physical and mental health and wellbeing of the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at info@imosphere.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.