YU LIFE LTD

YuLife

YuLife is a gamified wellbeing app that encourages healthy behaviours through daily challenges and rewards. Users earn YuCoin for healthy activities, redeemable for rewards or charitable donations, supporting engagement and personalised wellbeing journeys.
Additional features include Rewards & Recognition, in-app employee surveys and Employee Insights Dashboard.
Includes optional vGP/EAP.

Features

• Mobile App Access
• Analytics & Reporting
• Customisable Communications Hub
• HRIS Integration
• Gamified Engagement Tools
• Push Notifications & In-App Messaging
• Remote Onboarding & Support
• Wearable Device Integration
• Personalised Wellbeing Journeys
• Secure Data Handling

Benefits

• Daily wellbeing challenges
• Personalised wellbeing journeys
• Peer-to-peer recognition
• vGP & EAP Access
• Rewards & Recognition
• Wellbeing discounts and vouchers
• Rewards Store (Global and Local)
• Employee Experience Dashboard
• Integrated Wellbeing Content

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at adam.thornbury@yulife.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

821151568793679

Contact

Adam Thornbury
020 3870 2604
adam.thornbury@yulife.com

About your service

• Service categories:

  Applications

  Enterprise resource management

  Human capital management

  • Core Human Resources Applications
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: Compatible Android/iOS device required for installation.
• System requirements: YuLife app - compatible device required

User support

• Email or online ticketing support: No
• Phone support: No
• Web chat support: Yes, at an extra cost
• Web chat support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support accessibility standard: None or don’t know
• How the web chat support is accessible: If users are facing issues with the function of the YuLife app, they can speak to one of our Customer Happiness team via web chat. This may be inaccessible to users with visual impairments.
• Web chat accessibility testing: N/A
• Onsite support: Yes, at extra cost
• Support levels: Users at the Epic pricing tier get access to YuLife's real-time in-app support chat.; All users can access the online FAQ for self-service assistance.; HR managers have access to the self-serve HR Portal for admin and reporting.; Users at the Epic pricing tier are assigned an account manager who provides ongoing support to the client team, including onboarding, engagement campaigns, rewards and reporting on key metrics, as well as assistance with success plans.
• Support available to third parties: No
• AI chatbot: No

Onboarding and offboarding

• Getting started: YuLife’s launch process for the Epic pricing tier is a comprehensive, multi-stage approach designed to maximise user engagement and long-term success.; Planning (2–6 weeks): We collaborate with clients to define goals, timelines, and success metrics, conduct due diligence, provide HR portal access, and develop a communications pack tailored to the workforce.; Pre-Launch (6–10 weeks): Internal communications (“Buzz Time”) build anticipation. On Launch Day, employees receive app invites, supported by virtual and in-person explainer sessions to drive adoption and answer questions.; Launch & Immediate Post-Launch (First 30 Days): Employees are onboarded via app invitations and guided through setup. Engagement is driven by live sessions, push notifications, event banners, emails, and live chat. A 30-day review analyses engagement trends and feedback to inform next steps.; Ongoing Engagement: Structured reviews at 3 and 6 months assess engagement data and identify further adoption opportunities. Quarterly Business Reviews align engagement with business goals and provide detailed reporting. Clients have HR Portal access to monitor engagement, personalise communications, and make data-driven decisions.; Support: Dedicated Account Managers and Customer Happiness teams are available via in-app chat, with access to online FAQs, live data dashboards, and engagement campaign tools.; This process applies exclusively to the Epic pricing tier.
• Service documentation: Yes
• Documentation formats: PDF
• End-of-contract data extraction: When a YuLife contract ends, user data extraction and deletion are managed in line with data protection best practices and GDPR requirements. HR administrators or the Customer Happiness team can schedule data deletion, or users can request it directly. Upon contract termination, YuLife anonymises, purges or removes customer data containing confidential information from the application environment.; Importantly, all user activity data (such as steps, mindfulness minutes, and engagement metrics) is anonymised and aggregated before being shared with employers or extracted for reporting. This means that individual-level activity data is not provided; only anonymised, organisation-level statistics are available to ensure privacy and prevent identification of specific users, unless that user has consented to have their data exposed, for example, as part of a company challenge.; If a user or client requires a record of their data, YuLife can facilitate this process in accordance with its Data Retention Policy and subject to applicable privacy laws. For further details or to initiate a data extraction or deletion request, users should contact their HR administrator or the YuLife Customer Happiness team.
• End-of-contract process: At the end of a YuLife contract, customer data containing confidential information is securely purged or removed from the application environment in line with GDPR and best practices. Data deletion can be scheduled by HR administrators, the Customer Happiness team, or at the user’s request. ; At the end of the contract, each user will have 90 days to spend their YuCoin in the Rewards Store, after which point access to the Rewards Store is disabled. The user can keep using the app otherwise.
• Documentation accessibility standard: None or don’t know
• How the documentation is accessible: Accessible via pdf

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
• Application to install: Yes
• Compatible operating systems:
  • Android
  • IOS
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: The YuLife app is mobile only.; The admin HR Portal is primarily used on desktop.
• Service interface: Yes
• User support accessibility: None or don’t know
• Description of service interface: HRIS Integration: supports integration with HR systems, allowing for syncing employee data between your HRIS and YuLife. Full documentation is available for available integrations.; SFTP Data Exchange: Member data can be securely transferred to YuLife via SFTP, providing another technical interface for bulk data operations.; Web-Based Admin Portal: The HR Admin Portal is accessible via web browser and does not require installation, but this is not a service interface in the sense of an API.
• Accessibility standards: None or don’t know
• Description of accessibility: HR and admin users have access to a self-serve web portal with live dashboards, reporting, and the ability to personalise communications and wellbeing initiatives for their teams.; The portal allows for monitoring engagement, rewards, and other key metrics, and supports the management of user data and feedback.
• Accessibility testing: N/A
• API: No
• Customisation available: Yes
• Description of customisation: The 'Wellbeing Hub' feature within the YuLife app can be populated with custom content.; Buyers can run custom campaigns and events, in collaboration with their account manager.; Steps and Sudoku leaderboards are unique to the business, and can be split by employee department.

Scaling

• Independence of resources: Logical and Technical Segregation, Resilient Cloud Architecture, High Availability and Disaster Recovery, Continuous Monitoring and Alerting, Regular Testing and Review, Scalable Cloud Resources

Analytics

• Service usage metrics: Yes
• Metrics types: Users on the epic pricing tier can access a range of reports and metrics through their account manager on app uptake, app engagement, app activity, and rewards earnings and expenditure.; All users can access a simple analytics dashboard in the HR portal, as well as the employee experience dashboard, which measures different risks across the userbase.
• Reporting types:
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: Yes
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: None

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations:
  • United Kingdom
  • European Economic Area (EEA)
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CHECK service provider
• Protecting data at rest: Physical access control, complying with another standard
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type: Data Erasure

Data importing and exporting

• Data export approach: YuLife users can export their personal data by submitting a request through the in-app support feature or by contacting their HR/admin team. YuLife retrieves all data linked to the user’s unique identifier. The request is processed in line with GDPR, and the compiled data is provided in a portable format.
• Data export formats: CSV
• Data import formats: Other
• Other data import formats:
  • Activity via the YuLife app
  • HRIS Integrations

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: There is no official SLA in place for availability.; Historical uptime has been above 99.9% for the last two years.; Service status and historical uptime are transparently reported at status.yulife.com.
• Approach to resilience: YuLife operates on AWS in the London (eu-west-2) region, with data replicated across three independent availability zones. This ensures continued service even if one data centre experiences an outage.; All data is protected by immutable backup strategies using third-party providers. Backups are retained for 14 days and cannot be deleted or altered by YuLife, providing strong protection against ransomware and accidental loss.; YuLife maintains comprehensive business continuity and disaster recovery (BC/DR) plans, which are documented and tested at least annually. These plans ensure service continuity during major incidents or personnel unavailability.; YuLife is ISO27001:2022 certified, mandating strict controls for resilience, backup, and disaster recovery. Physical, technical, and environmental safeguards are enforced within AWS data centres.
• Outage reporting: Public dashboard: https://status.yulife.com/

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password
• Access restrictions in management interfaces and support channels: The admin portal enables account creation by invite link to the HR manager or similar individual, and login requires email address, password and 2FA is encouraged thereafter.; The YuLife app requires either an invite link (distributed manually via aforementioned portal) or a self-signup QR code for account creation (which then has the user confirm employee number and DoB.); App log-ins require email address and password thereafter.
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password

Audit information for users

• Access to user activity audit information: Users receive audit information on a regular basis
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards:
  • ISO/IEC 27001
  • Other
• Other security governance standards: SOC2 Type II; UK Cyber Essentials
• Information security policies and processes: We maintain a comprehensive Information Security Management System (ISMS) certified to ISO27001:2022, and is also SOC2 Type II accredited and Cyber Essentials certified. Our policies and processes are designed to protect data, ensure regulatory compliance (including UK GDPR), and maintain operational resilience.; Key elements:; Governance & Reporting:; - The Head of IT & Information Security is responsible for the overall security program, with board-level or equivalent authority.; - An Information Security Team supports policy implementation and compliance.; Policies & Reviews:; - Policies cover access control, data protection, incident response, business continuity, and more.; - All policies are reviewed and approved at least annually.; - Access rights (including privileged access) are managed on a least privilege basis and reviewed quarterly.; Training & Awareness:; - Mandatory security and privacy training is provided at onboarding and annually for all employees.; Incident Management:; - Documented incident response and breach notification processes are in place and tested regularly.; Compliance & Audits:; - Regular internal and external audits ensure ongoing compliance with ISO27001, SOC2, and GDPR requirements.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: YuLife tracks all service components through a comprehensive software and hardware inventory. Configuration and change management follow a documented, ISO27001:2022-certified process:; All changes are logged, tested, reviewed by 1–2 contributors, and approved before deployment, with clear segregation of duties.; Automated security testing and risk assessments are mandatory for every change to identify and mitigate potential security impacts.; Regular internal and external audits ensure compliance and process integrity throughout the component lifecycle.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: YuLife employs a robust vulnerability management process:; Threat Assessment: All applications and infrastructure undergo daily vulnerability scans and real-time monitoring using tools like Crowdstrike and MDM (e.g., JamF). Automated security testing and gating are integrated into the development lifecycle to block vulnerabilities before deployment.; Patch Deployment: Systems auto-update to the latest patches, with critical security patches typically installed within one month of release. Patch status is monitored continuously.; Threat Intelligence: Information on potential threats is sourced from real-time security tools, daily vulnerability scans, and industry-standard threat intelligence feeds.; This process is governed by our ISO27001:2022-certified ISMS.; yeswehack.com programme in place.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: Continuous monitoring by a SOC, tools like Crowdstrike and MDM, daily vulnerability scans.; Documented incident response policy, with multiple channels available for incident reporting.; - The monitoring and alerting systems are designed for real-time detection, enabling immediate escalation and response to incidents.; Fully UK GDPR compliant and will notify affected customers of incidents in accordance with regulatory requirements, which typically mandate prompt notification.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: Formal incident response policy with predefined processes for common security events, including clear roles and escalation paths. Users can report incidents via the in-app chat, by emailing support@yulife.com, or through their customer success account manager. All incidents are logged, investigated, and documented, with root cause analysis and preventative actions implemented. Incident reports are provided to affected customers as required, ensuring compliance with UK GDPR and contractual obligations.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 0%
• Between £2,500,001 and £5,000,000: 0%
• Over £5,000,001: 0%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: Prescient
• ISO/IEC 27001 accreditation date: Sunday 15 June 2025
• What the ISO/IEC 27001 doesn’t cover: Office is out of scope
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): No
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: Cc1d7f6c-20b0-4572-8e58-bbde554444a0
• Cyber essentials plus: No
• Cyber Essentials Alternative: None of the criteria
• Other security certifications: Yes
• Any other security certifications: SOC Type II

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Make Britain a clean energy superpower: To cut bills, create jobs and deliver security with cheaper, zero-carbon electricity by 2030, accelerating to net zero

    Policy Outcome 4: Sustainable procurement practices: Reducing carbon footprints, minimising waste, and promoting the use of clean energy and green technologies.

    • Understanding of how to influence staff, suppliers, customers, communities and/or any other appropriate stakeholders through the delivery of the contract to support climate and nature protection and improvement
    • Activities to reconnect people with the environment and increase awareness of ways to protect and enhance it

  • Mission: Build an NHS fit for the future: That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

    Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

    • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce
    • Actions to invest in the physical and mental health and wellbeing of the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at adam.thornbury@yulife.com. Tell them what format you need. It will help if you say what assistive technology you use.