Health Call

FormFinity

FormFinity is a flexible questionnaire solution that enables NHS organisations to create bespoke and commonly used patient-facing forms. Deployed as a standalone solution, forms are delivered to patients via SMS, or used alongside MyHealthCall PEP, questionnaires can be linked directly to outpatient appointments within the NHS App.

Features

• Create custom digital questionnaires for any clinical or operational need
• Configure text and guidance of patient notifications and landing pages
• Use trusted GDS‑compliant, step‑by‑step digital form flows
• Quickly send digital questionnaires directly to individual patients or cohorts
• Trigger SMS completion prompts using the GOV.UK Notify service
• Review and action patient responses through an intuitive dashboard
• Ensure full governance with Roles Based Access Controls (RBAC)
• Track form activity and completion status in real time
• Attach forms to patient appointments within the NHS App

Benefits

• Cost savings from reduced paper forms and postage
• Reduces administrative workload by automating questionnaire processing
• Digitally validates waiting lists efficiently, improving resource allocation
• Enhances collection of patient‑reported outcome measures
• Streamlines pre‑assessment to maximise clinical capacity
• Enables remote monitoring, allowing patients to live well at home
• Supports the delivery of Net Zero targets
• Improves patient experience and communication
• Improves access to timely, structured patient feedback
• No additional revenue added to NHS App notifications or SMS

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at enquiries@healthcallsolutions.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

743527613357177

Contact

Claire Graham
01916073615
enquiries@healthcallsolutions.com

About your service

• Service categories:

  Applications

  Content workflow and management

  • Capture

  Content services

  • Enterprise Content Management Applications
  • Content Sharing and Collaboration Applications
• Multi cloud support: No

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: MyHealthCall PEP; VirtualCare; NHS App
• Cloud deployment model: Public cloud
• Service constraints: Health Call's FormFinity Solution offers robust cloud-hosted digital functionality for streamlined data collection and patient engagement. However, buyers should be aware of potential constraints. There may be occasional planned maintenance periods to enhance system performance and security. We prioritise transparent communication regarding any constraints to minimise disruption and maximise user satisfaction. Our team is dedicated to providing comprehensive support and minimising any inconvenience for our valued customers.
• System requirements:
  • Modern web browser for access to the Management Portal
  • Standard internet connectivity for patient access via mobile/NHS App
  • No additional local software installation or on‑premise infrastructure is required

User support

• Email or online ticketing support: Yes
• Support response times: The Service Desk provides live telephone support Monday–Friday, 09:00–17:00, with 24/7 access to the online portal for incident logging and updates. Over 95% of calls are answered within 90 seconds. Incidents follow defined priority levels: Priority 1 acknowledged within 30 minutes, Priority 2 within 1 hour, Priority 3 within 8 business hours, and Priority 4 managed through routine scheduling. Service Requests receive an initial communication within 4 business hours. Governance channels (monthly, quarterly and ad‑hoc) ensure structured escalation and performance review. Enhanced 24/7/365 live support is available on request at additional cost.
• User can manage status and priority of support tickets: Yes
• Online ticketing support accessibility: WCAG 2.2 AA
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: We provide a structured, ITIL‑aligned support service through a central Service Desk. Live telephone support is available Monday–Friday (09:00–17:00), with 24/7 access to the online portal for incident logging and updates. Over 95% of inbound calls are answered within 90 seconds, ensuring rapid access to assistance. Incidents are managed using four priority levels: ; ; Priority 1 (Critical): Acknowledged within 30 minutes ; Priority 2 (High): Acknowledged within 1 hour ; Priority 3 (Standard): Acknowledged within 8 business hours ; Priority 4 (Low): Managed through routine scheduling ; ; Service Requests receive an initial communication within 4 business hours. All incidents, requests and enquiries follow defined workflows for Incident Management, Problem Management and Service Request fulfilment. Governance channels (monthly, quarterly and ad‑hoc) provide structured routes for raising queries, reviewing performance and agreeing improvement actions. ; ; Support Costs ; All standard support levels, including incident handling, service request fulfilment, reporting and governance activities, are included within the contracted service. Enhanced 24/7/365 live support can be provided upon request and is available at additional cost.
• Support available to third parties: No

Onboarding and offboarding

• Getting started: Our support is tailored to the needs of each organisation. Training can be provided remotely or onsite. A dedicated project manager is assigned for the duration of implementation. The following is included as standard:; - Project implementation management; - Project plan; - Structured governance; - RAID management; - Product user guide; - Test evidence and release notes for future releases; - DCB0129 and support with DCB0160; - Operations readiness planning; - Support is ongoing after go-live, and a dedicated account manager is assigned to all customers; - Our service desk offer includes a self-service area with FAQs and user guides; ; Additional training can be provided at additional cost.
• Service documentation: Yes
• Documentation formats: PDF
• End-of-contract data extraction: At contract end, Trust access to FormFinity is removed as part of a structured offboarding process. Prior to account deactivation, Trusts are supported to extract all required data. Form issue and response data can be exported using the inbuilt data export feature, while user audit data and patient audit data are generated and provided on request. This ensures that all records are securely transferred or archived in line with NHS information governance requirements before access is withdrawn.
• End-of-contract process: At the end of the contract, Health Call manages a controlled offboarding process in line with NHS standards, contractual obligations, and data protection legislation.; ; Contract closure activities include service termination, completion of agreed offboarding steps, and confirmation that all contractual obligations have been met. Health Call works with the customer to ensure an orderly conclusion of the service and a smooth transition where required.; ; The price of the contract includes access to the solution for the agreed term, initial setup and configuration, ongoing hosting, maintenance, regular updates and enhancements, and standard remote support delivered via email and the online support portal. Service management and reporting activities are included where defined within the contract.; ; Additional costs may apply for services outside the standard contract scope. These may include bespoke development or configuration, additional training, integrations with third-party systems, or other customer-specific requirements. Any additional services and associated costs are agreed in advance and documented through formal change control processes.; ; Following contract closure, Health Call ensures that customer data is handled in accordance with contractual terms and information governance requirements.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Patients access the service through the NHS App, or via browser link in mobile or desktop view. ; NHS organisation users access through a browser management portal (desktop only)
• Service interface: Yes
• User support accessibility: WCAG 2.2 AA
• Description of service interface: Organisation administrators access the FormFinity solution through their modern web browser and have access via a menu driven system to apply all the required setup and configuration for the solution. ; ; Organisation users can use the desktop browser solution to send forms to patients and manage the patient form responses.; ; Patients access the solution following receipt of an SMS message, or an NHS App notification. This contains a link to the questionnaire - after a landing page, the patient is then guided to access the digital form and respond to the questions using a simple and intuitive interface.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: Our platform complies with WCAG 2.2 AA and has been tested with assistive technologies including screen readers, keyboard‑only navigation, and browser zoom. We conducted user acceptance sessions with staff using accessibility tools to validate compatibility and identify improvements. Findings informed iterative design changes, ensuring the interface is usable and inclusive for all users.
• API: No
• Customisation available: Yes
• Description of customisation: The FormFinity solution is fundamentally meant to be customised allowing customers to implment bespoke and tailored digital questionnaires that meet local and national requirements. ; ; Role‑based access controls enable administrators to define who can manage distribution, responses, form response approval, and data export, ensuring governance and compliance.; ; The solution also allows the inclusion of trust defined or chosen embedded web links allowing flexibility to extend patient information and interaction

Scaling

• Independence of resources: FormFinity is built on PaaS services with dynamic horizontal and vertical scaling, ensuring capacity automatically adjusts to demand. This architecture guarantees that performance for individual users is not impacted by concurrent usage. Core services and databases scale in real time, maintaining consistent response times and availability even during peak activity.

Analytics

• Service usage metrics: Yes
• Metrics types: FormFinity provides detailed service metrics to support operational oversight and patient engagement. Reporting includes:; ; - User Audit: Tracks actions such as reading patient records, importing/exporting forms, assigning, and closing.; - Form Status: Monitors lifecycle states (unopened, opened, completed, expired, closed, auto‑closed).; - Form Metrics: Includes issue date, pathway ID, SMS volume, patient completion time, closure time, and % complete.; - Specialty Metrics: Segmented reporting by specialty for benchmarking and improvement.; - Demographic Metrics: Age range and sex breakdowns to support equality monitoring.; - Standardised Metrics: Wait list validation outcomes and Friends & Family Test responses.
• Reporting types: Regular reports
• Resource tagging: Yes
• FOCUS resource tagging: Yes

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Supplier-defined controls
• Penetration testing frequency: Less than once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest: Other
• Other data at rest protection approach: Our Cloud environment encrypts all data at rest by default using Transparent Data Encryption (TDE).; - Encryption is applied to:; - Database files (MDF/LDF); - Backups; - Transaction logs; - TempDB
• Data sanitisation process: Yes
• Equipment disposal approach: In-house destruction process
• Data sanitisation type: Data Erasure

Data importing and exporting

• Data export approach: Users can export form issue and response data directly using the inbuilt data export feature. User audit data (e.g. activity logs) and patient audit data can be generated and provided on request, ensuring Trusts have access to the information they need for governance, reporting, and compliance.
• Data export formats: CSV
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: Health Call guarantees service availability in line with the service levels defined within the customer contract.; ; The service is provided on a 24x7x365 operational basis, with business support hours of 09:00–17:00 (UK time), Monday to Friday, excluding public holidays. Availability is measured during business support hours.; Health Call commits to a minimum service availability of 99.90% during business support hours, excluding agreed planned maintenance windows. Planned maintenance is communicated in advance in accordance with contractual arrangements.; ; Service availability is monitored, and performance is reported to customers as part of regular service management and reporting processes.; Where guaranteed availability levels are not met, this is managed in line with the contractual service level agreement. Any service credits, remediation actions, or contractual remedies are applied in accordance with the terms agreed with the customer. Health Call works collaboratively with customers to investigate incidents, identify root causes, and implement corrective actions to prevent recurrence.; ; Availability commitments, measurement methodology, exclusions, and remedies are fully defined within the Service Definition and customer contracts.
• Approach to resilience: Health Call’s solution is hosted in Microsoft Azure, leveraging cloud architecture and platform services designed for resilience, high availability, and fault tolerance. The service is configured to operate across Azure Availability Zones, ensuring that compute, storage, and network components are distributed to withstand data centre-level failures without service interruption.; ; Resilience is achieved through multiple layers:; Redundant infrastructure: Azure’s underlying infrastructure provides built-in redundancy for critical components, including networking, storage, and compute.; Automated failover: Services are configured to support automated failover within and across Availability Zones to minimise the impact of component or zone failure.; Data durability: Data services are configured with replication and backup mechanisms, ensuring data remains available and recoverable in the event of infrastructure issues.; Monitoring and alerting: The environment is continuously monitored, with proactive alerting and incident response processes to detect and address issues before they impact users.; ; Planned maintenance is scheduled with notice, and resilience is tested as part of change control and operational assurance activities. Detailed architectural documentation is available on request under appropriate confidentiality
• Outage reporting: Health Call has an established process for communicating service outages and significant service issues.; ; In the event of an outage, affected customers are notified via email alerts as soon as the issue is confirmed. Updates are provided by email at appropriate intervals until the service is restored, in line with incident severity and service management processes.; ; Health Call does not provide a public status dashboard or an outage reporting API. Outage communications are managed directly with customers to ensure clear, accurate, and relevant information is shared.; ; All incidents and outages are recorded and reviewed as part of ongoing service management and reporting activities.

Identity and authentication

• User authentication needed: Yes
• User authentication: Multi-Factor Authentication (MFA)
• Access restrictions in management interfaces and support channels: Accessing the FormFinity admin portal is controlled through role‑based access controls and multi‑factor authentication, ensuring only authorised staff can log in. Permissions align to operational roles, with administrators granted additional capabilities. Access can be restricted by form type or specialty to minimise visibility.; All activity is recorded in audit logs, providing traceability of user actions. Support channels are limited to authenticated users via secure service desks. As a secure web application, all traffic is encrypted in transit to protect confidentiality and integrity.; This ensures management and support functions remain restricted and follow least‑privilege principles aligned to NHS information governance standards.
• Access restriction testing frequency: At least once a year
• Management access authentication: Multi-Factor Authentication (MFA)

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: User-defined

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: Other
• Other security governance standards: - Cyber Essentials Plus, providing independent assurance of technical controls ; - NHS Data Security and Protection Toolkit (DSPT) requirements ; - NHS England information governance and security standards ; - Microsoft Azure security and compliance controls, aligned to NHS and UK cloud‑security best practice ; - Internal security governance policies and risk management
• Information security policies and processes: Health Call has information security policies and processes in place to protect customer data and operate services securely, aligned to NHS information governance requirements.; Health Call is certified to Cyber Essentials Plus and completes the NHS Data Security and Protection Toolkit (DSPT) annually. These provide assurance that appropriate security controls are in place.; Security responsibilities and reporting lines are clearly defined, with processes for identifying, managing, and escalating security risks and incidents. Any security incidents are logged, investigated, and managed in line with agreed procedures.; Policies are shared with staff and supported through mandatory training and awareness activity. Compliance is monitored through regular review and security testing, including penetration testing.; The service is hosted within a secure Microsoft Azure environment, operating in line with NHS and cloud security best practice.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: All infrastructure is provisioned using infrastructure as code. All deployments are immutable. All code releases are atomic and managed via a central deployment system. All configuration is managed via a central Configuration management service with backing key vault for sensitive data.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: All services are protected by Cloudflare WAF and DDOS protection. ; Software package vulnerability is performed as part of our build process.; Hotfix patches for security issues can be deployed within the day. ; Vulnerability index https://learn.microsoft.com/en-us/nuget/api/vulnerability-info
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: All services are protected by Cloudflare WAF and DDOS protection, bot protection and exploit protection. ; We are notified about vulnerability changes from vulnerabilty indexes.; We can deploy hotfixes for vulnerability issues within the day.
• Incident management type: Supplier-defined controls
• Incident management approach: Identification: Detecting and reporting an incident through monitoring tools or user reports.; Logging: Documenting that their is a current incident; Mobilization: Creating an incident teams chat, inviting relevant team members ; Logging: Start transcription of the incident call to aid in post-incident review; Investigation: Diagnosing the cause of the incident and assessing its impact.; Mitigation: Implementing temporary fixes to restore service; Resolution: Applying permanent fixes and verifying that the incident is fully resolved.; Post-Incident Review: Conducting a review to analyze the incident, its causes, and the effectiveness of the response. Document lessons learned and update processes as necessary.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 0%
• Between £2,500,001 and £5,000,000: 0%
• Over £5,000,001: 0%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: No
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 3163167c-a738-48b7-8127-4930c587ea13
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: 7a2c12f8-8516-432e-8de3-549abc844bcc
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Plans to engage the contract workforce in deciding the most important workplace issues to address
    • Monitoring of employee engagement rates (by protected characteristic) and, where necessary, the development of actions to ensure all voices are heard across the diversity of the workforce
    • Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
    • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
    • Activities to cascade good practice on fair working conditions throughout the supply chain
    • Offer a pay and leave entitlement to all eligible staff who become kinship carers, ideally equivalent to statutory adoption pay and leave
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Understanding of in-work progression issues affecting the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
    • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
    • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors
    • How to ensure business decisions re: price/cost, short lead times, payment timescales do not create modern slavery risks in the supply chain

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

    • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

    • Understanding of the types of businesses in the market and the level of participation by new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutuals
    • Activities to identify opportunities to open up sub-contracts under the prime contract to a diverse range of businesses, including new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutuals
    • Activities that demonstrate a collaborative way to work with a diverse range of businesses as part of the supply chain
    • Understanding of local demographics, needs and opportunities for the co-design of the goods, services and works to be delivered under the contract
    • Methods for engaging with different parts of the community (including the education system and charities representing the community) and how communities come together to inform decisions, strategy and projects to leave a positive legacy for future generations
    • Measures to involve local stakeholders and/or users in design (e.g. in the design of services, systems, products or buildings)
    • Measures to engage users and communities and build relationships to increase community integration build trust and influence how the contract is delivered
    • Plans to respond flexibly and adapt approaches to community engagement and initiatives

  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Understanding of opportunities for additional environmental benefits delivery in the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Delivery of additional environmental benefits through the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
    • Understanding of how to influence staff, suppliers, customers, communities and/or any other appropriate stakeholders through the delivery of the contract to support climate and nature protection and improvement

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 6: Employment and training: For those who face barriers to employment

    • Creation of employment opportunities particularly for those who face barriers to employment, such as prison leavers, care leavers and/or who are located in deprived areas, and for people in industries with known skills shortages or in high growth sectors
    • Understanding of the issues affecting the representation of disabled people in the workforce in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
    • Inclusive and accessible recruitment practices, and retention-focused activities, including those provided in the Guide for line managers on recruiting, managing and developing people with a disability or health condition
    • Introducing transparency to pay and reward processes
    • Working conditions which promote an inclusive working environment and promote retention and progression
    • Understanding of the issues affecting inequality in employment, skills and pay in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors. Measures to tackle inequality in employment, skills and pay in the contract workforce
    • Inclusive and accessible development practices, including guidance for line managers on recruiting, managing and developing people with a disability or health condition

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 7: Creating a pipeline of opportunities: For the contract workforce, reducing barriers to entry for under-represented groups.

    • Understanding of the issues affecting the development of new skills by target cohort
    • Understanding of issues relating to entering the contract workforce

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
    • Understanding barriers to access to health and social care services or employment opportunities e.g. digital inclusion
    • Inclusive and accessible recruitment practices, development practices and retention policies that support-focused activities including those provided in the Guide for line managers on recruiting, managing and developing which support people with a disability or health condition
    • Actions to invest in the physical and mental health and wellbeing of the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at enquiries@healthcallsolutions.com. Tell them what format you need. It will help if you say what assistive technology you use.