Big Health Inc.

Daylight

Sleepio is a digital programme of Cognitive Behavioural Therapy for insomnia. It is designed for use as a treatment for people living with worry and anxiety. It is backed by strong clinical evidence (randomised control trial) and real-world evidence from across the NHS

Features

  • Fully automated, evidence-based digital CBT for anxiety
  • Available via clinical referral or self-referral
  • 24/7 access via desktop or accompanying app
  • Personalisation to each user based on questionnaire responses
  • Expert implementation support including CPD accredited training and tailored comms
  • Built on extensive research (RCT) and UK real world evidence

Benefits

  • Provide instant access to proven treatment for anxiety
  • Reduce health inequalities and unwarranted clinical variation in CBT delivery
  • Improve population health whilst driving supported self-management
  • Designed for scale: nationally available in Scotland
  • Partnership approach to implementation: driving behaviour change to sustainably embed
  • Easy to use, with engaging design and characters
  • Cope with sudden and unpredictable peaks in demand
  • Used across NHS workforce during the pandemic

Pricing

£70 a licence a year

Service documents

Request an accessible format
If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at will.goddard@bighealth.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 13

Service ID

7 8 1 5 2 9 3 7 5 7 3 4 2 8 5

Contact

Big Health Inc. Will Goddard
Telephone: 07793007705
Email: will.goddard@bighealth.com

Service scope

Software add-on or extension
No
Cloud deployment model
Private cloud
Service constraints
Sleepio is accessed via web browser and does not require a smartphone app for use.

However, an accompanying app is available if users wish.
System requirements
  • Modern web browser
  • Mobile device

User support

Email or online ticketing support
Email or online ticketing
Support response times
We reply to all emails sent within 24 business hours (Mon-Fri, 9-5pm US PT).

However, we also operate a limited weekend service beyond this, resulting in coverage of roughly 18 hours per day, 7 days per week.
User can manage status and priority of support tickets
No
Phone support
No
Web chat support
No
Onsite support
No
Support levels
Technical support is provided during business hours (Monday to Friday 9am to 5pm, US PT time) via email. This is our guaranteed minimum standard. Additional coverage is provided where possible, typically extending support to 18 hours per day, 7 days per week. 95% of support emails are responded to within 24 business hours. There is no additional charge for this support.
Support available to third parties
Yes

Onboarding and offboarding

Getting started
Big Health delivers a combination of on-site and remote education and training for healthcare professionals in primary care and community settings (GP practices, social prescribers) as well as IAPT services.

This is supplemented by a comprehensive online library of clinician-facing resources to enable healthcare professionals to refer patients to Sleepio. Big Health also provides patient-facing materials for waiting rooms and consultation rooms (e.g. leaflets, silent videos, welcome letters) to engage patients.

The Daylight onboarding process for patients is entirely self-guided, with all instructions included on-screen. Patients can also contact the User Support team directly via email without a Sleepio account, in the event of difficulties signing up.
Service documentation
Yes
Documentation formats
  • HTML
  • PDF
End-of-contract data extraction
Users can request their complete data export by contacting privacy@bighealth.com
End-of-contract process
At the end of the contract, a plan will be agreed with the client to ensure a safe transition, including communications to healthcare professionals who are referring patients to Daylight.

The contract end date will represent the final date on which patients can register for Daylight. Any patient that registers for Daylight before or on this date will continue to have a year's access to Daylight (even after the contract ends).

We will agree a date on which to provide a final outcomes report to the client. There is no additional cost incurred in this pricess

Using the service

Web browser interface
Yes
Supported browsers
  • Internet Explorer 11
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
Application to install
Yes
Compatible operating systems
  • Android
  • IOS
Designed for use on mobile devices
Yes
Differences between the mobile and desktop service
N/A
Service interface
No
User support accessibility
None or don’t know
API
No
Customisation available
No

Scaling

Independence of resources
Our system is provisioned to allow significantly higher load than we've experienced in real-world situations. We're moving systems to an auto-scaling system that will further ensure adequate resources for all load levels.

Analytics

Service usage metrics
Yes
Metrics types
We provide anonymised and aggregated outcomes reports to clients and key stakeholders, based on user-entered data. Reports cover the following areas: uptake of Daylight; anxiety recovery rates; mental health and wellbeing PROMs; user feedback.
Reporting types
Regular reports

Resellers

Supplier type
Not a reseller

Staff security

Staff security clearance
Conforms to BS7858:2019
Government security clearance
None

Asset protection

Knowledge of data storage and processing locations
Yes
Data storage and processing locations
  • United Kingdom
  • European Economic Area (EEA)
  • Other locations
User control over data storage and processing locations
No
Datacentre security standards
Complies with a recognised standard (for example CSA CCM version 3.0)
Penetration testing frequency
At least once a year
Penetration testing approach
Another external penetration testing organisation
Protecting data at rest
  • Physical access control, complying with CSA CCM v3.0
  • Physical access control, complying with SSAE-16 / ISAE 3402
  • Encryption of all physical media
Data sanitisation process
Yes
Data sanitisation type
  • Explicit overwriting of storage before reallocation
  • Deleted data can’t be directly accessed
Equipment disposal approach
Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

Data export approach
Users can request their complete data export by contacting privacy@bighealth.com
Data export formats
CSV
Data import formats
Other

Data-in-transit protection

Data protection between buyer and supplier networks
TLS (version 1.2 or above)
Data protection within supplier network
TLS (version 1.2 or above)

Availability and resilience

Guaranteed availability
Daylight is accessible 24/7 and Big Health will use best endeavours consistent with prevailing industry standards to minimise errors and interruptions in the service.

An availability Service Level Agreement may be agreed with individual customers where desired.
Approach to resilience
All web applications and APIs have multiple load-balanced servers running at all times. These systems use dynamic routing that allows for automated fail-over handling

Regular backups are taken and tested, allowing us to set RPO / RTO of 24 hours / 72 hours, respectively. Backups are stored in geographically diverse locations.
Outage reporting
Outages will be reported via email notifications

Identity and authentication

User authentication needed
Yes
User authentication
  • Identity federation with existing provider (for example Google Apps)
  • Username or password
Access restrictions in management interfaces and support channels
Employee access to production systems requires authentication (public key w/ enforced multi-factor authentication) to a secure VPN.

All support channels (email and "user help desk") require username/password with enforced multi-factor
Access restriction testing frequency
At least every 6 months
Management access authentication
  • 2-factor authentication
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password

Audit information for users

Access to user activity audit information
You control when users can access audit information
How long user audit data is stored for
At least 12 months
Access to supplier activity audit information
You control when users can access audit information
How long supplier audit data is stored for
At least 12 months
How long system logs are stored for
At least 12 months

Standards and certifications

ISO/IEC 27001 certification
No
ISO 28000:2007 certification
No
CSA STAR certification
No
PCI certification
Yes
Who accredited the PCI DSS certification
Trustwave
PCI DSS accreditation date
28/02/2013
What the PCI DSS doesn’t cover
All systems are covered -- we only process payment informations in a small part of the system, but the certification covers our entire system. We do not store patient information in our systems.
Cyber essentials
Yes
Cyber essentials plus
No
Other security certifications
Yes
Any other security certifications
HITRUST

Security governance

Named board-level person responsible for service security
Yes
Security governance certified
Yes
Security governance standards
Other
Other security governance standards
HITRUST (includes ISO 2700x series, HIPAA, PCI, NIST, and other control sets)
Information security policies and processes
The Security, Privacy, and Compliance officer is responsible for overseeing all information security processes. This position reports directly to the VP of Engineering. Regular audits are conducted to ensure adherence with all Big Health policies and processes. Copies of processes and policies are available upon request. In general, we follow the principles of minimum necessary / least privilege, data minimization, and tight control of PII / PHI.

Operational security

Configuration and change management standard
Supplier-defined controls
Configuration and change management approach
All changes made to systems are tracked and auditable (including seeing which individual was responsible for the change)

All changes to systems must go through the following process:
- Automated unit testing
- Manual peer code review (including security assessments)
- Manual user acceptance testing, including fuzzing and boundary checking
- Regression testing
- Release smoke testing
Vulnerability management type
Supplier-defined controls
Vulnerability management approach
Automated vulnerability scanning is performed monthly on all production systems.

Antivirus / anti-malware software is running on all servers and workstations, with real-time alerting to the security team, as well as definitions updated at least daily.

All systems feed directly into our Security Incident Event Management (SIEM) system, which automatically conducts pattern analysis and alerts the security team of any potential incidents

Patches are released based on severity, with critical patches being deployed within 10 days.
Protective monitoring type
Supplier-defined controls
Protective monitoring approach
We utilize automated intrusion detection / intrusion prevention systems on all servers

These systems feed into our SIEM, which alerts the security team of any potential compromises

When possible, the IDS / IPS will automatically respond to prevent further compromise. If manual intervention is required, critical issues have response / remediate / resolve objectives of 2 hours, 24 hours, and 5 days, respectively.
Incident management type
Supplier-defined controls
Incident management approach
We have a well-defined incident response policy with discrete identification, containment, eradication, recovery, and follow-up phases.

User can report incidents directly to security@bighealth.com

Incident reports are communicated internally to the Senior Leadership Team and may be made available externally when applicable.

Secure development

Approach to secure software development best practice
Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v3.0)

Public sector networks

Connection to public sector networks
No

Social Value

Fighting climate change

Fighting climate change

As a digital first service, we reduce the requirement for patients to travel for face to face treatment. This contributes to a reduction in emissions
Covid-19 recovery

Covid-19 recovery

Daylight is available 24/7 and reduces the strain on the NHS workforce to support the rising mental health needs of the population during COVID-19
Wellbeing

Wellbeing

As a digital treatment for insomnia, a common mental health condition, Sleepio is often made available to the workforce of a contracting organisation. Real world evidence shows Sleepio has a positive impact on the wellbeing of workers.

Pricing

Price
£70 a licence a year
Discount for educational organisations
No
Free trial available
No

Service documents

Request an accessible format
If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at will.goddard@bighealth.com. Tell them what format you need. It will help if you say what assistive technology you use.