KOOTH DIGITAL HEALTH LIMITED

Qwell: Digital Mental Health Platform for Adults

Since 2001 Kooth Digital Health has been the UK’s leading provider to the NHS and Local Authorities in effective online mental health support. Qwell is a safe and welcoming space for adults to explore their mental health through a tailored clinical model and vibrant online community offering therapeutic choice.

Features

• Safe, clinically moderated and age gated support.
• Available 24/7, 365 including out of hours support.
• Vibrant community providing moderated peer to peer support.
• Self help tools and clinically evidenced psycho-educational content.
• Text-based chats through a drop-in ‘function’.
• Pre-booked chats with the same practitioner, supporting continuity of care.
• Access to asynchronous support
• Fully digital platform, compatible with all devices (including apple, android).
• Dedicated local engagement leads promoting wellbeing within the community.
• Robust Clinical Governance and Clinically Evidenced Outcome measures.

Benefits

• A humanistic, integrative, ‘whole-person’ approach to digital therapeutic support.
• Wellbeing and early intervention focus to support improved population health.
• Digital platform to support increased access and remove stigma.
• Data-rich insights - regular reporting on population mental health.
• Goals-based outcomes for service users to track their progress.
• Ease of access, self referral or be referred by clinicians.
• NHSE MHSDS reporting as standard (18-24 years).
• BACP-accredited.
• Experienced safeguarding team and proven systems to support risk.
• YHEC-demonstrated economic value.

Service documents

• Pricing document

  ODT

• Service definition document

  ODT

• Terms and conditions

  ODT

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at tenders@kooth.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

730879622217329

Contact

Kooth Tenders
02039849337
tenders@kooth.com

About your service

• Service categories:

  Applications

  Production and operations

  Service industry and public sector operations

  • Healthcare
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: Constraints might include planned maintenance arrangements or support being limited to specific hardware configurations.; ; Users need access to an internet-enabled device to access support.
• System requirements:
  • Service users need an internet-enabled device to access support.
  • Service users need a web browser to access the service.

User support

• Email or online ticketing support: Yes
• Support response times: We do not offer an SLA for responding to support requests.
• User can manage status and priority of support tickets: No
• Phone support: No
• Web chat support: No
• Onsite support: No
• Support levels: We provide one homogenous level of support for all customers. Our site and workforce are nationally accessible, differentiated only for the service user. The core site is the same. Any reported issues are dealt with by our in-house team of on-call engineers as soon as possible.
• Support available to third parties: No

Onboarding and offboarding

• Getting started: We deliver a mix of in-person assemblies and virtual information sessions, supported by tailored resources, to ensure service users and referrers can easily access or refer to our services.; ; The service is designed to be intuitive and approachable, and does not require additional training or documentation.
• Service documentation: No
• End-of-contract data extraction: Kooth Digital Health Limited has a privacy policy that service users agree to upon signing up for the service. The policy is accessible and can be reviewed at any time. This policy provides information on accessing records, clearly written for all service users. Where appropriate, practitioners can explain to service users that they have a right to see their files, to provide further clarity and support with any access request or process, and that anonymity is compromised during this process due to the need to evidence who they are. This right to see information is known as a Subject Access Request. Subject Access Requests can be made by emailing via dpo@kooth.com. Service users will be prompted to complete a form. This form, as well as Kooth’s internal review process, instils that anonymity is kept to a minimum and that their request is reviewed for potential harm and compliance with ICO guidelines.
• End-of-contract process: Off-boarding is a technically simple process for Qwell as a Commercial off- the-shelf (COTS) web-based platform. If a commissioning authority decides to decommission Qwell, the platform itself can simply be "turned off" for the region and the sign up flow adjusted to no longer contain the related locations and sub-locations for which Qwell was previously commissioned. For service users, the process requires clinical and safeguarding governance. Initially the site will no longer accept new registrations for the specific locations while existing Service Users are slowly off-boarded to other local services that align with their specific needs. This is done in conjunction with commissioning authority to ensure service user safety. Service User data will also be deleted to ensure compliance with GDPR and our retention policy. This process is conducted in line with the guidelines set out in the NHS Data Security & Protection Toolkit on which Kooth Digital Health is registered/assessed. All is included in the price of the contract at no additional cost.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: All functionality is retained on the mobile version of the platform.
• Service interface: Yes
• User support accessibility: WCAG 2.2 AA
• Description of service interface: Qwell's user interface allows service users to, among other things, join an impromptu or scheduled one-to-one chats with mental health professionals, participate in forums, read and write magazine articles, set goals. All the content users see is pre-moderated to avoid any trigger content. The whole interface is based on HTML CSS and JavaScript user interface component. We've designed and built a fully WCAG 2.2 AA compliant library of re-usable User Interface components, leveraging the usability and accessibility research and patterns from the GDS Design System.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: All services are audited against the WCAG 2.2 AA standard. We do not perform regular testing with individual users.
• API: No
• Customisation available: No

Scaling

• Independence of resources: Service resilience is considered and built into the technical design. System resource utilization is actively monitored and capacity-planned to prevent scaling bottlenecks. Some infrastructure auto-scales based on demand.

Analytics

• Service usage metrics: Yes
• Metrics types: A broad range of service usage and journey metrics broken down by service type and user cohort.
• Reporting types:
  • Regular reports
  • Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: None

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Encryption of all physical media
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Explicit overwriting of storage before reallocation / Secure Erase

Data importing and exporting

• Data export approach: Users can export their data by making a subject access request through their account to a practitioner who will then escalate this via internal processes. This is done so users can maintain their anonymity, in contrast with direct email approach. Users can also email the Data Protection Officer at DPO@kooth.com with such a request, although in doing so will compromise their anonymity as a user.
• Data export formats: Other
• Data import formats: Other
• Other data import formats: Users cannot import their data

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: Kooth Digital Health does not commit to specific Service Level Agreements (SLAs) for our service. We do however use SLO (service level objectives.) Our SLO for the core service is 99.65% availability across a seven-day period. This is equivalent to a single five-minute outage per day. In practice our availability never falls below 99.95%. Our response time for a Severity Level 1 alert is within 30 minutes. We run our services as high availability which ensures that data and other resources are stored across at least two availability zones within the Google Cloud Platform region. Kooth Digital Health data is hosted in the europe-west-2 region (London) of the Google Cloud Platform. Data hosted at this location is used for service delivery. We run our services as high availability which ensures that data and other resources are stored across at least two availability zones within the Google Cloud Platform region. Kooth Digital Health data is hosted in the europe-west-2 region (London) of the Google Cloud Platform. Data hosted at this location is used for service delivery.
• Approach to resilience: Kooth Digital Health's service compute infrastructure is run on Google Cloud Platform and provisioned across three availability zones. Each zone runs separate physical infrastructure and is resilient to other zones becoming unavailable. Kooth Digital Health's data infrastructure is run on GCP (Cloud SQL) and configured to be high availability. Each database runs with an active master and a passive standby in different availability zones. Data is replicated at a disk level between the zones. In the event of the master failing (e.g. due to utility failure) the database would fail over to the stand- by zone and continue running. All services are run in Google Cloud data centres with redundant power supplies and back-up generators.
• Outage reporting: A public dashboard provides close-to-immediate information on outages. Additionally, customers will be regularly informed of incidents and outages that have affected the system after the fact. The Regional Manager in charge of the contract will reach out to the commissioning authority to ensure they have complete transparency.; ; For planned outages, customers will receive one week notice in advance.

Identity and authentication

• User authentication needed: Yes
• User authentication: Username or password
• Access restrictions in management interfaces and support channels: Access to management interfaces and sensitive channels is restricted in a manner consistent with the SOC 2, ISO 27001 and NIST standards. All staff and contractors must have sufficiently complex passwords. Access to email, documents and service infrastructure is controlled by Google Single Sign On with two-factor authentication. Source Code is stored in GitHub and engineering staff are required to have two factor authentication enabled. Staff are required to use a password manager for storing passwords and system credentials. System credentials are securely generated according to industry best practice. All access requests are vetted by a security team.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: We have an internal set of policies and processes designed in accordance with the SOC 2, ISO 27001 and NIST standards. Formal responsibility for information security rests with the DPO. On a day-to-day basis the CTO manages and implements the policy and related procedures. Internal controls ensure that permanent and temporary employees, trainees and contractors are aware of: information security policies applicable in their work areas, their personal responsibilities concerning information security, and how to access information security advice. Internal controls ensure that all staff comply with information security procedures including the maintenance and management of data confidentiality, data integrity and data erasure. Failure to comply with policies may result in disciplinary action being taken. All of this is encapsulated in DP-04 (A) Data Security & Information Governance Policy
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: Changes are agreed and documented in Kooth Digital Health's quality management system (QMS). References to changed code or configuration are tracked in there. Changes are programmatically applied to test environments managed by automated configuration management. Signed off changes are released to production environments and recorded via an automated process. All changes to production pass through technical quality reviews: code review, quality review, product sign-off and continuous external security review and monitoring. Engineers review OWASP principles as part of design and implementation activities.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: Processes are designed to include controls that adhere to the SOC 2, ISO 27001 and NIST standards.; ; We subscribe to notifications of vulnerabilities from all providers. Vulnerability notifications are assessed for impact and are patched by engineers or automatically via our public cloud provider, Google Cloud Platform, which hosts our data and service infrastructure. Most patches can be deployed within an hour. We engage external providers to test our technical systems for vulnerabilities at least once a year as well as performing larger-scale ad-hoc automated security tests. We use monitoring to alert the engineering team to any attack taking place.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: Processes are designed to include controls that satisfy the SOC 2, ISO 27001 and NIST standards.; ; We have monitoring in place to prevent any potential accidental or malicious leaks of data from our servers and databases. We monitor our service for common attacks and block them at the edge of our network. All actions on our infrastructure are logged for auditing purposes. Any employee has a responsibility to report suspected data breaches. An investigation will be started within 24 hours of a breach being discovered, following steps laid out in our data breach policy.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: Processes are designed to include controls that satisfy the SOC 2, ISO 27001 and NIST standards.; ; A Severity Level 1 incident is defined as any incident preventing use by a significant number of practitioners or service users; response time is within 30 minutes. We have comprehensive documentation for on call engineers on how to respond to alerts. Customers can report incidents, however most incidents are caught by automated monitoring. Incident reports are routinely created and available on request. We notify customers of major impacts to their services or data after the fact.
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 1%
• Between £250,000 and £500,000: 2.5%
• Between £500,001 and £1,000,000: 4%
• Between £1,000,001 and £2,500,000: 8%
• Between £2,500,001 and £5,000,000: 12%
• Over £5,000,001: 12%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: British Standards Institution (BSI)
• ISO/IEC 27001 accreditation date: Friday 10 November 2023
• What the ISO/IEC 27001 doesn’t cover: Nothing is excluded.
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: F9ad1705-7f18-4cbc-9104-83991f66efba
• Cyber essentials plus: No
• Cyber Essentials Alternative: None of the criteria
• Other security certifications: Yes
• Any other security certifications: NHS Data Security and Protection Toolkit

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

    • Understanding of local demographics, needs and opportunities for the co-design of the goods, services and works to be delivered under the contract
    • Methods for engaging with different parts of the community (including the education system and charities representing the community) and how communities come together to inform decisions, strategy and projects to leave a positive legacy for future generations
    • Measures to engage users and communities and build relationships to increase community integration build trust and influence how the contract is delivered
    • Plans to respond flexibly and adapt approaches to community engagement and initiatives

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 6: Employment and training: For those who face barriers to employment

    • Understanding of the issues affecting inequality in employment, skills and pay in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors. Measures to tackle inequality in employment, skills and pay in the contract workforce

Service documents

• Pricing document

  ODT

• Service definition document

  ODT

• Terms and conditions

  ODT

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at tenders@kooth.com. Tell them what format you need. It will help if you say what assistive technology you use.