BENETALK LTD

SuperPenguin: SLCN Platform for Families (SPMA)

SuperPenguin SLCN Platform for Families (SPMA) is a mobile application (iOS/Android) providing evidence-based therapeutic content for families and carers supporting children and adults with Speech, Language, and Communication Needs (SLCN). It works seamlessly with SuperPenguin: SLCN Platform for Clinical Management to deliver integrated NHS digital-first care pathways.

Features

• 13 clinically-validated content modules covering paediatric and adult needs
• Mobile app for families accessible 24/7 on iOS/Android
• Web dashboard for NHS clinicians with real-time analytics
• Personalised content recommendations based on family clinical pathway needs
• Unlimited clinician seats with lifelong family platform access
• Extended family access for parents, teachers, and caregivers
• Remote monitoring intelligence supporting the entire clinical care pathway
• All future content modules included at no additional cost
• Full NHS compliance: ISO 13485, DCB0129, NHS DSPT certified
• UKCA Class I Medical Device

Benefits

• Reduces NHS waiting list pressure through early digital intervention
• Supports 70% of standard NHS SLT caseloads digitally
• Accelerates clinical outcomes through high-dosage daily home practice
• Prevents waitlist deterioration with immediate evidence-based family activities
• Enables measurement-based care with standardised evidence-based interventions
• Reduce in person support with evidence-based strategies between appointments
• Drives efficiency replacing paper materials with digital delivery
• Supports Greener NHS by reducing patient travel to clinics
• Supports health equity by reaching underserved populations
• Aligns with NHS 10-Year Plan and Waiting Well strategy

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at speak@superpenguin.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

678450642630866

Contact

Jordi Fernandez
02080500402
speak@superpenguin.com

About your service

• Service categories:

  Application Development and Deployment

  AI platforms

  • Search and knowledge discovery

  AI software services

  • Personalize AI Software Services
• Multi cloud support: No

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: SuperPenguin SLCN Platform for Clinical Management (SPWD)
• Cloud deployment model: Private cloud
• Service constraints: SuperPenguin: SLCN Platform for Clinical Management is designed for NHS clinicians and service managers. ; ; Technical support is available during UK business hours (Monday-Friday, 9am-5pm GMT). ; ; Minimum Annual Service Fee: £25,000. ; ; Minimum contract period: 12 months.
• System requirements:
  • IOS 14.0 or later for iPhone/iPad (for SPMA)
  • Android 8.0 or later for Android (for SPMA)
  • Internet connection for initial setup and content sync
  • Minimum 100MB storage space on mobile device

User support

• Email or online ticketing support: Yes
• Support response times: For routine queries and minor issues, we respond within two (2) Business Days. For major incidents significantly disrupting service or preventing use of core functions, we respond within four (4) Business Hours during support hours (Monday to Friday, 9am-5pm UK time), with best efforts to provide a workaround or resolution as quickly as possible.
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: All SuperPenguin customers receive Standard Support as part of their subscription.; ; Standard Support (included at no extra cost):; - Channels: Email-based support for technical and usage queries, plus scheduled online meetings when needed.; - Hours: Monday to Friday, 9am–5pm UK time (excluding UK public holidays).; - Response times:; - Minor incidents (non-urgent queries, feature requests, minor issues): response within two (2) Business Days.; - Major incidents (significant disruption or inability to use core functions): response within four (4) Business Hours, with best efforts to provide a workaround or resolution as quickly as possible.; - Maintenance: Bug fixes, patches and minor updates included for the duration of the contract.; - Account management: Each NHS organisation is assigned a dedicated account manager providing onboarding support, regular check-ins and quarterly business reviews.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: **Standard Implementation: 6 weeks from contract signing**; ; Weeks 1-2: Technical setup, IG sign-off, trust-specific configuration, SSO integration; ; Weeks 3-4: Clinical team training, workflow integration planning; ; Weeks 5-6: Distribution of welcome packs, Go-Live, dedicated support; ; **Online training:** One-hour staff webinar covering dashboard functionality, deployment, and data privacy. Video tutorials and guides accessible within the platform. Train-the-trainer sessions for sustainable internal capability.; ; **User documentation:** Instructions for Use (IFU) provided as part of UKCA medical device labelling. Deployment pack with QR codes and setup instructions for family distribution. Template communications (parent letters, text messages) to support rollout. Role-specific guidance for administrators and clinical users.; ; **Onboarding support:** Named account manager for each NHS trust. Activation keys issued within 48 hours of purchase order confirmation. Kick-off call to configure organisation settings and access permissions. Monthly/quarterly check-in calls to review uptake and address questions.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
• End-of-contract data extraction: At contract end, data handling is governed by the Data Sharing Agreement:; - Client data can be transferred to the authority upon request; - Remaining data is anonymised or securely deleted in accordance with retention obligations; - A deletion certificate is provided confirming data disposal; - All transfers comply with GDPR data portability requirements
• End-of-contract process: Upon contract termination or expiry (no additional cost):; ; 1. Access termination — Client organisation and users cease access to SuperPenguin services; 2. Data handling options— In accordance with the Data Sharing Agreement:; - Client data can be transferred to the authority upon request; - Remaining data is anonymised or securely deleted per agreed retention obligations; 3. Deletion confirmation — A deletion certificate is provided confirming secure data disposal; 4. Audit trail — Data disposal logs are maintained for compliance purposes; ; All data handling complies with GDPR requirements and the terms set out in the Data Sharing Agreement and Data Protection Impact Assessment.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: No
• Application to install: Yes
• Compatible operating systems:
  • Android
  • IOS
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: SuperPenguin Mobile App (SPMA) is a mobile-only service specifically for carers of children with SLCN optimised for iOS and Android devices. Features include offline content access, evidence based assessments, and media playback optimised for mobile. There is no desktop version of the SPMA, however SuperPenguin Web Dashboard (SPWD) is a desktop-only web application specifically for clinicians. Features include full analytics and reporting, referral management, and user administration. SPWD is not available on mobile devices.
• Service interface: Yes
• User support accessibility: WCAG 2.2 AA
• Description of service interface: SuperPenguin SLCN Platform for Families (SPMA) is a mobile-only service specifically for carers of children with SLCN optimised for iOS and Android devices. Features include offline content access, evidence based assessments, and media playback optimised for mobile. There is no desktop version of the SPMA, however SuperPenguin Web Dashboard (SPWD) is a desktop-only web application specifically for clinicians. Features include full analytics and reporting, referral management, and user administration. SPWD is not available on mobile devices.
• Accessibility standards: None or don’t know
• Description of accessibility: SuperPenguin is committed to WCAG 2.2 Level AA accessibility with full conformance targeted by Q4 2026.; ; **Current accessibility features:**; ; - Subtitles and transcripts for all video content; - Plain language aligned with early secondary reading level; - Basic accessibility tagging implemented; - Clear navigation and consistent interface design; - No flashing content (photosensitivity safe); ; **Roadmap Milestones:**; ; - Q2 2026: Accessibility audit and detailed accessibility statement publication; - Q3 2026: Remediate critical issues; implement automated accessibility testing; - Q4 2026: Achieve full WCAG 2.2 AA conformance with third-party verification; ; Accessibility statement available at https://www.superpenguin.com/accessibility
• Accessibility testing: Accessibility evaluation to date:; ; - Usability testing with diverse user groups focusing on clarity, comprehension, and functional use; - Limited manual and automated accessibility checks against WCAG 2.2 criteria; - Basic accessibility tagging and colour contrast verification; ; A comprehensive accessibility review by an independent assessor is scheduled for Q2 2026.
• API: No
• Customisation available: Yes
• Description of customisation: SuperPenguin customisation options:; - Trust branding (logo, colours); - Custom content modules (at extra cost); - Custom assessment questionnaires (at extra cost); - Localised content (at extra cost); - Custom reporting templates

Scaling

• Independence of resources: SuperPenguin uses Google Cloud Platform's auto-scaling infrastructure to ensure consistent performance regardless of demand:; ; - Automatic horizontal scaling adjusts compute resources based on load; - Cloud Firestore provides automatic scaling with no provisioned capacity limits; - Firebase services scale independently per tenant; - Load balancing distributes traffic across multiple instances; - CDN caching reduces origin server load for static content; - Logical tenant separation ensures data isolation between NHS trusts; - Rate limiting prevents any single user from monopolising resources; - Performance monitoring with automated alerts for capacity planning; ; Designed to handle peak demand without degrading service for other users.

Analytics

• Service usage metrics: Yes
• Metrics types: SuperPenguin provides comprehensive analytics:; ; - User engagement metrics (daily/weekly/monthly active users); - Content consumption analytics (views, completions, time spent); - Assessment completion rates and validated outcomes; - Referral activation and conversion rates; - Individual family progress monitoring; - Service-level aggregated reporting for commissioning evidence; - System uptime and availability metrics; ; All metrics available via real-time dashboards and exportable reports.
• Reporting types:
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: None

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
• User control over data storage and processing locations: No
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest: Encryption of all physical media
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type: Data Erasure

Data importing and exporting

• Data export approach: • Engagement analytics viewable via the SuperPenguin Web Dashboard (topics viewed, time spent, activity completion); • Analytics reports can be exported as PDF or CSV from the dashboard; • Aggregated service data shared with clients on a monthly basis
• Data export formats: CSV
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: Service Availability: 99.5% measured monthly; ; SuperPenguin guarantees 99.5% service availability, calculated as total monthly minutes minus unplanned downtime, divided by total monthly minutes.; ; Infrastructure Basis:; SuperPenguin is hosted on Google Cloud Platform (Firebase), which provides a 99.95% uptime SLA. Our 99.5% commitment includes a conservative buffer for application-layer maintenance, deployments, and incident response.; ; Exclusions:; ; - Scheduled maintenance (performed outside core NHS hours with advance notice); - Force majeure events; - Issues caused by buyer's systems or third-party integrations; ; Measurement:; Availability is monitored continuously via automated health checks. Monthly uptime reports are available upon request.; ; Remedies:; If availability falls below 99.5% in any calendar month, affected buyers may request service credits towards future invoices, calculated proportionally to the shortfall.
• Approach to resilience: Available on request
• Outage reporting: SuperPenguin reports outages via email alerts in line with NHS contract requirements. Authorised contacts at each NHS organisation are notified by email, including:; ; - Description of the issue; - Affected components; - Expected impact; - Estimated time to resolution; ; Updates provided by follow-up email until normal service is restored. Scheduled maintenance notified at least 7 days in advance.

Identity and authentication

• User authentication needed: Yes
• User authentication: Multi-Factor Authentication (MFA)
• Access restrictions in management interfaces and support channels: Access to the web dashboard is restricted through role-based access controls, with permissions defined by user type - clinicians, trust administrators - each with specific functions. SSO via Microsoft 365 / NHS credentials provides authentication with automatic role assignment and 30-minute session timeout. All role changes are logged in an audit trail. Support channel access is limited to authorised contacts at each NHS trust, with a dedicated account manager assigned per organisation.
• Access restriction testing frequency: At least once a year
• Management access authentication: Multi-Factor Authentication (MFA)

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: No
• Security governance approach: BeneTalk follows secure by design and secure by default practices across the software lifecycle, aligned with recognised best practice such as ISO/IEC 27001, NCSC guidance, and formal vulnerability management and incident response processes. The principles in the Software Security Code of Practice are already reflected in our secure development, deployment, vulnerability management and customer communication processes, and are overseen through our ISO 27001 compliant ISMS covering all SuperPenguin services.
• Information security policies and processes: BeneTalk operates an ISO/IEC 27001 certified Information Security Management System with documented policies for information security, data protection and privacy, access control, acceptable use, remote working, incident management and change management. Information security is owned at executive level, with defined roles and responsibilities and regular risk reviews. Compliance is ensured through mandatory annual security awareness training, formal change and incident workflows, protective monitoring and vulnerability management, plus internal audits, management review and external certification (ISO 27001 compliance, Cyber Essentials, NHS DSPT, DCB0129).
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: Configuration and change management follows documented ISO 27001 and ISO 13485 procedures. Software components and dependencies are version controlled and traceable through source repositories. All changes are assessed for security impact before approval, with changes affecting security controls subject to additional review. Vulnerability testing is conducted prior to release, and protective monitoring detects issues post deployment.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: Vulnerability management follows ISO 27001 controls, NCSC guidance and Cyber Essentials requirements. Potential threats are assessed through automated scanning, real time protective monitoring with anomaly detection, and annual penetration testing (methodology aligned with OWASP/PTES). Critical issues are prioritised for rapid remediation; routine patches are applied through scheduled maintenance. Threat intelligence is drawn from vendor advisories, platform alerts and industry sources.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: SuperPenguin implements comprehensive monitoring:; - Real-time application performance monitoring via Google Cloud; - Security event logging and alerting; - Automated anomaly detection for unusual access patterns; - 24/7 infrastructure monitoring with automated alerts; - Log retention for 12 months for security analysis; - Regular review of security logs as part of ISO 27001 processes; - Incident response procedures documented and tested
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: SuperPenguin maintains a formal incident management process:; - Documented incident response plan aligned with ISO 27001; - Defined severity levels and escalation procedures; - Named incident response team with clear responsibilities; - Communication protocols for notifying affected customers; - Post-incident review and lessons learned process; - GDPR-compliant breach notification within 72 hours; - Regular incident response exercises and tabletop testing; - DCB0129 clinical safety incident reporting procedures
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Conforms to a recognised standard, but self-assessed

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 10%
• Between £500,001 and £1,000,000: 15%
• Between £1,000,001 and £2,500,000: 20%
• Between £2,500,001 and £5,000,000: 25%
• Over £5,000,001: 30%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: No
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 19c653c8-f2f6-4359-a431-caa975b6de0a
• Cyber essentials plus: No
• Cyber Essentials Alternative: You do not have a current and valid Cyber Essentials Plus certificate, or will not have in place within 12 months of the date of award but have an IASME certified equivalent.
• Other security certifications: Yes
• Any other security certifications: NHS Data Security and Protection Toolkit

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Actions to invest in the physical and mental health and wellbeing of the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at speak@superpenguin.com. Tell them what format you need. It will help if you say what assistive technology you use.