Daylight
Sleepio is a digital programme of Cognitive Behavioural Therapy for insomnia. It is designed for use as a treatment for people living with worry and anxiety. It is backed by strong clinical evidence (randomised control trial) and real-world evidence from across the NHS
Features
- Fully automated, evidence-based digital CBT for anxiety
- Available via clinical referral or self-referral
- 24/7 access via desktop or accompanying app
- Personalisation to each user based on questionnaire responses
- Expert implementation support including CPD accredited training and tailored comms
- Built on extensive research (RCT) and UK real world evidence
Benefits
- Provide instant access to proven treatment for anxiety
- Reduce health inequalities and unwarranted clinical variation in CBT delivery
- Improve population health whilst driving supported self-management
- Designed for scale: nationally available in Scotland
- Partnership approach to implementation: driving behaviour change to sustainably embed
- Easy to use, with engaging design and characters
- Cope with sudden and unpredictable peaks in demand
- Used across NHS workforce during the pandemic
Pricing
£70 a licence a year
Service documents
Request an accessible format
Framework
G-Cloud 13
Service ID
7 8 1 5 2 9 3 7 5 7 3 4 2 8 5
Contact
Big Health Inc.
Will Goddard
Telephone: 07793007705
Email: will.goddard@bighealth.com
Service scope
- Software add-on or extension
- No
- Cloud deployment model
- Private cloud
- Service constraints
-
Sleepio is accessed via web browser and does not require a smartphone app for use.
However, an accompanying app is available if users wish. - System requirements
-
- Modern web browser
- Mobile device
User support
- Email or online ticketing support
- Email or online ticketing
- Support response times
-
We reply to all emails sent within 24 business hours (Mon-Fri, 9-5pm US PT).
However, we also operate a limited weekend service beyond this, resulting in coverage of roughly 18 hours per day, 7 days per week. - User can manage status and priority of support tickets
- No
- Phone support
- No
- Web chat support
- No
- Onsite support
- No
- Support levels
- Technical support is provided during business hours (Monday to Friday 9am to 5pm, US PT time) via email. This is our guaranteed minimum standard. Additional coverage is provided where possible, typically extending support to 18 hours per day, 7 days per week. 95% of support emails are responded to within 24 business hours. There is no additional charge for this support.
- Support available to third parties
- Yes
Onboarding and offboarding
- Getting started
-
Big Health delivers a combination of on-site and remote education and training for healthcare professionals in primary care and community settings (GP practices, social prescribers) as well as IAPT services.
This is supplemented by a comprehensive online library of clinician-facing resources to enable healthcare professionals to refer patients to Sleepio. Big Health also provides patient-facing materials for waiting rooms and consultation rooms (e.g. leaflets, silent videos, welcome letters) to engage patients.
The Daylight onboarding process for patients is entirely self-guided, with all instructions included on-screen. Patients can also contact the User Support team directly via email without a Sleepio account, in the event of difficulties signing up. - Service documentation
- Yes
- Documentation formats
-
- HTML
- End-of-contract data extraction
- Users can request their complete data export by contacting privacy@bighealth.com
- End-of-contract process
-
At the end of the contract, a plan will be agreed with the client to ensure a safe transition, including communications to healthcare professionals who are referring patients to Daylight.
The contract end date will represent the final date on which patients can register for Daylight. Any patient that registers for Daylight before or on this date will continue to have a year's access to Daylight (even after the contract ends).
We will agree a date on which to provide a final outcomes report to the client. There is no additional cost incurred in this pricess
Using the service
- Web browser interface
- Yes
- Supported browsers
-
- Internet Explorer 11
- Microsoft Edge
- Firefox
- Chrome
- Safari
- Opera
- Application to install
- Yes
- Compatible operating systems
-
- Android
- IOS
- Designed for use on mobile devices
- Yes
- Differences between the mobile and desktop service
- N/A
- Service interface
- No
- User support accessibility
- None or don’t know
- API
- No
- Customisation available
- No
Scaling
- Independence of resources
- Our system is provisioned to allow significantly higher load than we've experienced in real-world situations. We're moving systems to an auto-scaling system that will further ensure adequate resources for all load levels.
Analytics
- Service usage metrics
- Yes
- Metrics types
- We provide anonymised and aggregated outcomes reports to clients and key stakeholders, based on user-entered data. Reports cover the following areas: uptake of Daylight; anxiety recovery rates; mental health and wellbeing PROMs; user feedback.
- Reporting types
- Regular reports
Resellers
- Supplier type
- Not a reseller
Staff security
- Staff security clearance
- Conforms to BS7858:2019
- Government security clearance
- None
Asset protection
- Knowledge of data storage and processing locations
- Yes
- Data storage and processing locations
-
- United Kingdom
- European Economic Area (EEA)
- Other locations
- User control over data storage and processing locations
- No
- Datacentre security standards
- Complies with a recognised standard (for example CSA CCM version 3.0)
- Penetration testing frequency
- At least once a year
- Penetration testing approach
- Another external penetration testing organisation
- Protecting data at rest
-
- Physical access control, complying with CSA CCM v3.0
- Physical access control, complying with SSAE-16 / ISAE 3402
- Encryption of all physical media
- Data sanitisation process
- Yes
- Data sanitisation type
-
- Explicit overwriting of storage before reallocation
- Deleted data can’t be directly accessed
- Equipment disposal approach
- Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001
Data importing and exporting
- Data export approach
- Users can request their complete data export by contacting privacy@bighealth.com
- Data export formats
- CSV
- Data import formats
- Other
Data-in-transit protection
- Data protection between buyer and supplier networks
- TLS (version 1.2 or above)
- Data protection within supplier network
- TLS (version 1.2 or above)
Availability and resilience
- Guaranteed availability
-
Daylight is accessible 24/7 and Big Health will use best endeavours consistent with prevailing industry standards to minimise errors and interruptions in the service.
An availability Service Level Agreement may be agreed with individual customers where desired. - Approach to resilience
-
All web applications and APIs have multiple load-balanced servers running at all times. These systems use dynamic routing that allows for automated fail-over handling
Regular backups are taken and tested, allowing us to set RPO / RTO of 24 hours / 72 hours, respectively. Backups are stored in geographically diverse locations. - Outage reporting
- Outages will be reported via email notifications
Identity and authentication
- User authentication needed
- Yes
- User authentication
-
- Identity federation with existing provider (for example Google Apps)
- Username or password
- Access restrictions in management interfaces and support channels
-
Employee access to production systems requires authentication (public key w/ enforced multi-factor authentication) to a secure VPN.
All support channels (email and "user help desk") require username/password with enforced multi-factor - Access restriction testing frequency
- At least every 6 months
- Management access authentication
-
- 2-factor authentication
- Public key authentication (including by TLS client certificate)
- Identity federation with existing provider (for example Google Apps)
- Username or password
Audit information for users
- Access to user activity audit information
- You control when users can access audit information
- How long user audit data is stored for
- At least 12 months
- Access to supplier activity audit information
- You control when users can access audit information
- How long supplier audit data is stored for
- At least 12 months
- How long system logs are stored for
- At least 12 months
Standards and certifications
- ISO/IEC 27001 certification
- No
- ISO 28000:2007 certification
- No
- CSA STAR certification
- No
- PCI certification
- Yes
- Who accredited the PCI DSS certification
- Trustwave
- PCI DSS accreditation date
- 28/02/2013
- What the PCI DSS doesn’t cover
- All systems are covered -- we only process payment informations in a small part of the system, but the certification covers our entire system. We do not store patient information in our systems.
- Cyber essentials
- Yes
- Cyber essentials plus
- No
- Other security certifications
- Yes
- Any other security certifications
- HITRUST
Security governance
- Named board-level person responsible for service security
- Yes
- Security governance certified
- Yes
- Security governance standards
- Other
- Other security governance standards
- HITRUST (includes ISO 2700x series, HIPAA, PCI, NIST, and other control sets)
- Information security policies and processes
- The Security, Privacy, and Compliance officer is responsible for overseeing all information security processes. This position reports directly to the VP of Engineering. Regular audits are conducted to ensure adherence with all Big Health policies and processes. Copies of processes and policies are available upon request. In general, we follow the principles of minimum necessary / least privilege, data minimization, and tight control of PII / PHI.
Operational security
- Configuration and change management standard
- Supplier-defined controls
- Configuration and change management approach
-
All changes made to systems are tracked and auditable (including seeing which individual was responsible for the change)
All changes to systems must go through the following process:
- Automated unit testing
- Manual peer code review (including security assessments)
- Manual user acceptance testing, including fuzzing and boundary checking
- Regression testing
- Release smoke testing - Vulnerability management type
- Supplier-defined controls
- Vulnerability management approach
-
Automated vulnerability scanning is performed monthly on all production systems.
Antivirus / anti-malware software is running on all servers and workstations, with real-time alerting to the security team, as well as definitions updated at least daily.
All systems feed directly into our Security Incident Event Management (SIEM) system, which automatically conducts pattern analysis and alerts the security team of any potential incidents
Patches are released based on severity, with critical patches being deployed within 10 days. - Protective monitoring type
- Supplier-defined controls
- Protective monitoring approach
-
We utilize automated intrusion detection / intrusion prevention systems on all servers
These systems feed into our SIEM, which alerts the security team of any potential compromises
When possible, the IDS / IPS will automatically respond to prevent further compromise. If manual intervention is required, critical issues have response / remediate / resolve objectives of 2 hours, 24 hours, and 5 days, respectively. - Incident management type
- Supplier-defined controls
- Incident management approach
-
We have a well-defined incident response policy with discrete identification, containment, eradication, recovery, and follow-up phases.
User can report incidents directly to security@bighealth.com
Incident reports are communicated internally to the Senior Leadership Team and may be made available externally when applicable.
Secure development
- Approach to secure software development best practice
- Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v3.0)
Public sector networks
- Connection to public sector networks
- No
Social Value
- Fighting climate change
-
Fighting climate change
As a digital first service, we reduce the requirement for patients to travel for face to face treatment. This contributes to a reduction in emissions - Covid-19 recovery
-
Covid-19 recovery
Daylight is available 24/7 and reduces the strain on the NHS workforce to support the rising mental health needs of the population during COVID-19 - Wellbeing
-
Wellbeing
As a digital treatment for insomnia, a common mental health condition, Sleepio is often made available to the workforce of a contracting organisation. Real world evidence shows Sleepio has a positive impact on the wellbeing of workers.
Pricing
- Price
- £70 a licence a year
- Discount for educational organisations
- No
- Free trial available
- No