SISU Health

SISU Health Prevention and Population Health Data Analytics Platform

A fully managed Software as a Service that provides self-service health assessments through SiSU Health Stations, with digital results, personalised health information, and population health data reporting delivered via the SiSU Health Platform on supplier hosted infrastructure.

Features

• Self-service biometric measurements including blood pressure, weight and body composition
• Digital health surveys with validated lifestyle and risk assessment scoring
• Cloud-hosted platform with secure UK data storage and processing
• Real-time reporting dashboards for population-level health insights
• User access via mobile app and web portal
• Automated rules engine for referrals, nudges and follow-up actions
• Integration options for data exchange

Benefits

• Identify health risks early using consistent, validated measurements
• Increase engagement through simple, self-service health assessments
• Reduce admin workload with automated data capture and reporting
• Improve decision-making using real-time population health insights
• Support targeted interventions with clear risk segmentation dashboards
• Empower users with instant results and personalised health pathways
• Streamline workflows with automated nudges and follow-up actions
• Enhance organisational wellbeing programmes using accurate, repeatable data.
• Improve accessibility with remote access on mobile and web
• Improve accessibility and reach through self-service health kiosks

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at sales@sisuhealth.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

791678136575545

Contact

Samantha Fay
07857035864
sales@sisuhealth.co.uk

About your service

• Service categories:

  Application Development and Deployment

  Analytics and business intelligence

  • Business Intelligence
  • Advanced and predictive analytics
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: Requires reliable internet connectivity at Health Station location to enable real-time data transfer and reporting. Temporary reduced functionality may occur during planned maintenance, scheduled outside peak hours and communicated in advance. All SiSU Health Station hardware is supplied, installed, maintained and supported by SiSU. Buyers are not required to manage, configure or maintain any hardware or infrastructure. Hardware availability is subject to manufacturing lead times. API integrations may require additional configuration time and depend on the buyer’s technical readiness. Some features require the latest supported versions of web browsers or mobile operating systems. Standard support provided during UK business hours.
• System requirements:
  • Reliable internet connection for each SiSU Health Station
  • Standard power outlet for Health Station operation
  • Modern web browser for admin portal access
  • Current iOS or Android version for mobile app use
  • Physical space to safely install Health Station hardware
  • Integrations require buyer coordination for data exchange only; no infrastructure

User support

• Email or online ticketing support: Yes
• Support response times: We respond to questions within one business day during standard support hours (Monday to Friday, 09:00–17:00 UK time).; We acknowledge urgent issues within four hours during these hours.; Outside business hours and on weekends, responses are provided on the next working day.
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes
• Support levels: As standard, we provide a qualified technician to implement and maintain the service. We respond to questions within one business day during standard support hours (Monday to Friday, 09:00–17:00 UK time). Urgent issues are acknowledged within four hours during these hours. Outside business hours and on weekends, responses are provided on the next working day.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Onsite installation of supplier‑managed SiSU Health Stations is provided by the supplier, including configuration, testing and operational readiness. Buyers are not required to perform technical installation or infrastructure configuration. ; Users are provided simple step, by step instructions
• Service documentation: No
• End-of-contract data extraction: Users can export their data or request data deletion.
• End-of-contract process: Supplier‑owned Health Stations are collected by the supplier and the client is off‑boarded from the SaaS platform. All included in the price.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Both provide users access to personal health results, surveys and digital health information. The mobile version contains more interactive health challenges, and digital resources.
• Service interface: Yes
• User support accessibility: WCAG 2.2 AA
• Description of service interface: A reporting interface can be provided to access population health data reports.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: We have not yet carried out direct testing of the service with users of assistive technologies. However, the interface has been developed using standard accessibility guidelines and good practice. We plan to undertake formal accessibility and assistive technology testing as part of future development cycles and will incorporate user feedback to improve accessibility over time.
• API: No
• Customisation available: Yes
• Description of customisation: Buyers cannot customise the underlying software but configurations can be provided such as information screens, local pathways and data transfers.

Scaling

• Independence of resources: We use a scalable cloud architecture hosted in the AWS UK Region, which automatically allocates resources based on demand. This ensures that activity from one customer does not affect the performance of others. The platform uses load balancing, containerised services and database scaling to maintain stable performance during periods of higher usage. We continuously monitor system performance and capacity, and increase resources as required.

Analytics

• Service usage metrics: Yes
• Metrics types: We provide detailed reports on the use of the platform. This includes patterns of use, and aggregated anonymised data about the users.
• Reporting types:
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • Other locations
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest:
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Encryption of all physical media
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type: Deleted data can’t be directly accessed / Cryptographic Erasure

Data importing and exporting

• Data export approach: Users export from the app in the form of a table
• Data export formats: CSV
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: 99% uptime
• Approach to resilience: Our service is hosted in the AWS UK Region using a highly available, multi-Availability Zone architecture. AWS provides resilient power, networking and environmental controls, with automatic failover between Availability Zones. The platform uses load balancing, replicated databases, automated backups and continuous monitoring to maintain performance and availability. Capacity is scaled as required to manage demand. Disaster recovery procedures are in place
• Outage reporting: Email alerts

Identity and authentication

• User authentication needed: Yes
• User authentication: Username or password
• Access restrictions in management interfaces and support channels: Access to management interfaces is restricted using role-based access controls, allowing only authorised staff to view or change administrative settings. permissions are assigned on a least-privilege basis; Support staff use controlled, audited systems and can only access information needed to resolve an issue
• Access restriction testing frequency: At least once a year
• Management access authentication: Username or password

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: We operate an ISO 27001-certified Information Security Management System covering all aspects of information security, such as access control, asset management, incident management, risk management, business continuity and supplier assurance. Policies are reviewed at least annually or following significant changes.; Information security is overseen by the Senior Leadership Team. All staff receive security awareness training and must follow defined processes for handling data, reporting incidents and managing access. Compliance is verified through internal audits, external certification audits and continuous monitoring of risks, controls and improvement actions.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: We follow a structured configuration and change management process as part of our ISO 27001. ; All service components are recorded in an asset register and tracked throughout their lifecycle, including versioning and configuration history. ; Changes to the platform follow a documented workflow that includes impact assessment, security review, approval and testing before deployment.; Security impacts are assessed for each change, including potential effects on data confidentiality, integrity and availability. ; Higher-risk changes require additional review and sign-off.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: Potential threats to the service are assessed through regular vulnerability scanning, security monitoring and review of threat intelligence. ; Identified vulnerabilities are risk-assessed based on severity and potential impact on confidentiality, integrity and availability.; Critical and high-severity issues are prioritised and patches are applied as soon as practicable, following testing and change control procedures.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: We use a combination of automated monitoring, alerting and log analysis to identify potential compromises.; When a potential compromise is identified, it is triaged immediately, investigated by authorised personnel and managed in line with our incident response procedures.; High-severity incidents are responded to as quickly as possible and normally within the same business day. Actions taken, findings and remediation steps are recorded and reviewed as part of continuous improvement.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: We operate a defined incident management process as part of our ISO/IEC 27001-certified ISMS. ; All incidents follow a structured workflow including logging, triage, investigation, containment, remediation and closure.; Users can report incidents through our support channels, including email and the service desk. Reported incidents are acknowledged within defined response times and escalated according to severity.; Post-incident reviews support continuous improvement.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 2%
• Between £500,001 and £1,000,000: 3%
• Between £1,000,001 and £2,500,000: 5%
• Between £2,500,001 and £5,000,000: 7%
• Over £5,000,001: 10%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: 3CT Security Ltd.
• ISO/IEC 27001 accreditation date: Monday 23 December 2024
• What the ISO/IEC 27001 doesn’t cover: Development and Physical currently not in scope.
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: 50f07894-938d-4a3d-9230-c2a49b0c9f17
• Cyber essentials plus: No
• Cyber Essentials Alternative: In relation to the services you do not have a current and valid Cyber Essentials Plus certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials Plus certificate by one of the government approved accreditation bodies within 12 months of the date of award.
• Other security certifications: Yes
• Any other security certifications: NHS Data Security and Protection Toolkit DSPT

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
    • Understanding barriers to access to health and social care services or employment opportunities e.g. digital inclusion

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at sales@sisuhealth.co.uk. Tell them what format you need. It will help if you say what assistive technology you use.