CIRDAN IMAGING LIMITED

Clinician and Patient Portal

Portals are available for Clinicians and Patients..
The portal provides a clear presentation of laboratory results within the applicable reference range via a clear slider display, on browsers or iOS/Android mobile devices
The multifunctional portal can highlight required test actions, recommend test or services, reducing the administrative burden and costs.

Features

• Clear presentation of laboratory results within applicable reference ranges
• Practitioner management of clinical results
• Reporting of diagnostic test results
• Support for OIDC (Open ID Connect) Authentication
• Cybersecure with Role-Based Access Control

Benefits

• Easily scalable from small, single laboratories to large, multi-site laboratories.
• Rapid on-boarding process with training and configuration service available.
• Presented across Web, iOS and Android front end applications
• Separate Patient, Practitioner and Administrator portals to meet differing needs
• Clinical alerts for practitioners
• Supports the NHS drive enabling patient access to health records
• Secure for data at rest/in transit (confirms to ISO/IEC 27001:2013).
• Proactive monitoring tools.

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at presales@cirdan.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

788681640754630

Contact

Presales Team
02892660880
presales@cirdan.com

About the service

• Service categories:
  • Applications
    • Production and operations
      • Service industry and public sector operations
        • Healthcare
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model: Private cloud
• Service constraints: Access to our help desk is limited to the service hours defined within the SLA provided. Systems are provided fully-configured and ready to use. ; ; Software patches and updates will be periodically provided as required and Cirdan will endeavour to provide and install these with minimal impact to BAU operations
• System requirements:
  • Single non-exclusive licence allows client employees to access the System.
  • Client may not sell, distribute, gift, or resell System services.
  • System access limited to purchased users and purchased external interfaces.
  • All System users must be properly trained and proficient.
  • Licence includes access, hosting, maintenance, and technical support services.
  • Licence duration has a minimum term of two years.
  • Licence expires at term end unless otherwise agreed contractually.
  • Early termination allowed only for contract breach with dispute procedures.
  • Cirdan retains all copyright and intellectual property for the System.

User support

• Email or online ticketing support: Yes
• Support response times: Cirdan offer a fully managed 24/7/365 support model. The terms are laid out in our SLA which is agreed with the customer during contract negotiations and an example is enclosed with this response.
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: Please see sample SLA document provided.; ; As we offer a Fully Managed Service for this product the costs are included in the overall cost of the product.
• Support available to third parties: No

Onboarding and offboarding

• Getting started: Training is delivered in accordance with the needs of each organisation. We will develop individual, tailored training courses specific to the needs of the individuals being trained.; Training can be delivered using a variety of different methods including cascade (train-the-trainer) training, classroom-style demonstrations, focus groups, workshops, online webinars and video tutorials.; Training packages are available for clinicians, scientists, pathologists, administrators and IT staff. Training is structured, specific, comprehensive and targeted for users grouped by role. We believe in involving users from the start to ensure they have input to the process and agree the outcomes required for each user group. Remote training can be provided for updates with new features, significant changes of specific features and minor upgrades.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • ODF
  • PDF
• Documentation accessibility standard: WCAG 2.2 AA
• End-of-contract data extraction: Customers do not extract the data. Cirdan are responsible for the proper extraction and hand over as per contract terms and conditions.
• End-of-contract process: As per an example customer contract, Cirdan ensure the following:; 1. Upon the termination or expiration of the contract, Cirdan shall promptly provide the Customer with all relevant data owned or controlled by them, in a mutually agreed-upon format, within a reasonable time from the effective date of termination or expiration.; 2. The Customer retains the right to request the data in a structured, commonly used, and machine-readable format to facilitate easy import and access.; 3. Cirdan shall ensure that all data provided to the Customer is complete, accurate, and securely transferred, in accordance with applicable data protection laws and regulations.; 4. Cirdan shall not retain any copies of the exported data, and shall promptly delete or destroy any remaining copies, in accordance with applicable data protection laws and regulations, unless otherwise required by law.; 5. Both parties shall cooperate in good faith to facilitate the smooth and orderly transfer of data, and shall take all necessary measures to protect the confidentiality and integrity of the data during the export process.; 6. This clause shall survive the termination or expiration of this contract and remain in effect until all data has been successfully exported and delivered to the Customer.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
• Application to install: Yes
• Compatible operating systems:
  • Android
  • IOS
  • Windows
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Scaled for the device.
• Service interface: Yes
• Description of service interface: Access to the application is via a mobile app or Cloud based Web User Interface (WUI), with user access controlled via RBAC / AD. ; ; The Clinician and Patient Portals can be used independently or together, in either standalone mode or integrated with an existing LIMS/LIS solution.; ; Reporting via graphical representation and curated medical content improves the speed and clarity of test results, ensuring informed empowerment & engagement of the patient in clinical decisions with a view to improving clinical outcomes. The application also facilitates clinician to patient messaging.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: Designed to be highly flexible and accessible, allowing users to interact with the system through a variety of methods and devices. The main ways a user can use the application:; Web Interface:; Mobile Devices:; System Interfaces:; Manual and Automated Entry:; Keyboard and Mouse:; Touch Screen:; System Integration:; Customizable Interface:
• User support accessibility: WCAG 2.2 AA
• API: Yes
• What users can and can't do using the API: The system supports integration with external systems via standard APIs and interfaces, including HL7, FHIR, REST, SOAP, and flat files. This enables automated setup and configuration of data and workflows.; Users can update existing system data definitions and setup tables using electronic uploads (e.g., CSV, TSV, or direct database extraction). Data can be amended as required, and changes are tracked in the audit trail.; The system allows for changes to configuration, such as updating reference ranges, code tables, and rules, through electronic means. These changes can be versioned and scheduled to take effect at a specified date.; Only authorized users can make changes to setup tables or configurations. Security levels and role-based access control (RBAC) are enforced to restrict access to sensitive functions.; The system supports setup and configuration through scripted imports and integration interfaces, with robust audit trails and security controls. Changes are typically made via file import or integration modules rather than a public API, and access is restricted to authorized users. The system allows for the population of setup tables using script import in addition to manual entry. This is commonly performed using flat files (CSV or TSV), which can be imported directly into the system.
• API documentation: Yes
• API documentation formats: Open API (also known as Swagger)
• API sandbox or test environment: Yes
• Customisation available: No

Scaling

• Independence of resources: Cirdan monitor key telemetry indicators and inform the customer of potential issues, observations, e.g. rogue processes, and recommended options, e.g. clearing down data files or increasing capacity.

Analytics

• Service usage metrics: Yes
• Metrics types: Cirdan monitor key telemetry indicators and inform the customer of potential issues, observations, e.g. rogue processes, and recommended options, e.g. clearing down data files or increasing capacity.
• Reporting types: Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Supplier type

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least once a year
• Penetration testing approach: NCSC approved service provider
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Physical access control, complying with another standard
  • Encryption of all physical media
  • Scale, obfuscating techniques, or data storage sharding
  • Other
• Other data at rest protection approach: Data at rest is secured via Microsoft Azure standards. MS Azure implements multiple standards for protecting data at rest.
• Data sanitisation process: Yes
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Data Erasure
• Equipment disposal approach: A third-party destruction service

Data importing and exporting

• Data export approach: How users export their data is up to the user once it has been extracted and passed to the user.
• Data export formats: Other
• Other data export formats: Any commonly used structured format.
• Data import formats: Other
• Other data import formats: Any commonly used structured format.

Data-in-transit protection

• Data protection between buyer and supplier networks: IPsec or TLS VPN gateway
• Data protection within supplier network: Other
• Other protection within supplier network: Cirdan employs a comprehensive set of data protection methods to ensure the security, integrity, and confidentiality of information:; Encryption and Access Control; Audit Trails; Compliance with Standards and Legislation; Data Integrity and Backup; Remote and Mobile Access Security; Change Control and Versioning

Availability and resilience

• Guaranteed availability: Please see attached.; 'Cirdan sample SLA - Managed Service Cloud based SLA'
• Approach to resilience: Available on request.
• Outage reporting: Email alerts

Identity and authentication

• User authentication needed: Yes
• User authentication: Username or password
• Access restrictions in management interfaces and support channels: Role Based Access Control (RBAC)
• Access restriction testing frequency: At least every 6 months
• Management access authentication: Username or password

Audit information for users

• Access to user activity audit information: Users have access to real-time audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users have access to real-time audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Software Security Code of Practice: Yes
• Security governance certified: Yes
• Security governance standards:
  • CSA CSM version 4.0
  • ISO/IEC 27001
  • Other
• Other security governance standards: Cirdan is registered and complies with the NHS Data Security and Protection Toolkit. ODS code is 8J717, ICO registration number: ZA018472
• Information security policies and processes: Cloud infrastructure is deployed using highly available components and services with proactive monitoring in place to cover OS, application and database events. Cloud environmental events are the responsibility of the cloud provider. Access is granted via RBAC using a least privilege model. Audit trails are maintained and monitored with alerting for suspicious activity. All software required to support the product are maintained and controlled external to the customer environment with access granted via RBAC using a least privilege model. ; ; The database backend has several safeguards built-in to ensure there is no database inconsistency and system failure, with data being encrypted at rest and in-transit in line with NHS standards.

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: This is covered by our internal IQMS and Design Change Management Procedure.
• Vulnerability management type: Undisclosed
• Vulnerability management approach: We would prefer not to describe the process for security reasons. We are happy to discuss with the potential customer.
• Protective monitoring type: Undisclosed
• Protective monitoring approach: We would prefer not to describe the process for security reasons. We are happy to discuss with the potential customer.
• Incident management type: Supplier-defined controls
• Post-quantum cryptography secure: No
• Incident management approach: The Cirdan Support System (CSS) is a gateway for Customers into the Support Desk Team. It allows interaction and acts as a central repository for all communication between Customers and the Support Desk Team.; Either a member of the Support Desk Team or the Customer will log an incident into the CSS. This incident will be assigned an ‘incident number’ and will initially include the type and nature of the issue reported and the priority assigned.; The Support Desk Team will use this incident for logging all actions taken to resolve the issue.

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 1%
• Between £2,500,001 and £5,000,000: 2%
• Over £5,000,001: 3%

Standards and certifications

• ISO/IEC 27001 certification: Yes
• ISO/IEC 27001 accredited by: Nqa
• ISO/IEC 27001 accreditation date: Tuesday 15 January 2019
• What the ISO/IEC 27001 doesn’t cover: Nothing listed
• ISO 28000:2022 certification: No
• ISO 9001 certification: Yes
• ISO 9001 certification accredited by: BSI
• ISO 9001 accreditation date: Saturday 26 July 2025
• What the ISO 9001 doesn’t cover: Nothing listed
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: No
• Cyber Essentials Alternative: In relation to the services you do not have a current and valid Cyber Essentials certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials certificate by one of the government approved accreditation bodies within 12 months of the date of award.
• Cyber essentials plus: No
• Cyber Essentials Alternative: In relation to the services you do not have a current and valid Cyber Essentials Plus certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials Plus certificate by one of the government approved accreditation bodies within 12 months of the date of award.
• Other security certifications: Yes
• Any other security certifications:
  • DSPT
  • ICO Registration Certificate

Social value

• Mission: Kick start economic growth:

  To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

  Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

  • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing

  Policy Outcome 2: Skills for growth: Supporting growth sectors and addressing skills gaps.

  • Support for educational attainment relevant to the contract, including training schemes that address skills gaps and result in recognised qualifications

  Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

  • Activities that demonstrate a collaborative way to work with a diverse range of businesses as part of the supply chain
• Mission: Make Britain a clean energy superpower:

  To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

  Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

  • Delivery of additional environmental benefits through the performance of the contract, including working towards net zero carbon emissions and use of clean energy and green technologies
• Mission: Break down barriers to opportunity:

  By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

  Policy Outcome 6: Employment and training: For those who face barriers to employment

  • Introducing transparency to pay and reward processes

  Policy Outcome 7: Creating a pipeline of opportunities: For the contract workforce, reducing barriers to entry for under-represented groups.

  • Other measures to offer development opportunities for the target cohort(s) in the contract workforce
• Mission: Build an NHS fit for the future:

  That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

  Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

  • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at presales@cirdan.com. Tell them what format you need. It will help if you say what assistive technology you use.