Sword Health

Sword Intelligence

Sword Intelligence is an AI transformation partner for NHS trusts and healthcare organisations. Providing composable AI agents that automate administrative workflows, improve patient engagement & care coordination via referral management, no-show prevention and contact centre voice-AI. Our solutions integrate seamlessly, reducing administrative burden and freeing staff to focus on care.

Features

• AI Care Managers (agents)
• Integrations with existing systems
• Security, compliance & data-protection standards
• Real-time monitoring, oversight & human-in-the-loop control
• Multilingual Voice AI
• Document processing
• Workflow automation & orchestration
• Modular & scalable design
• Multichannel communication (e.g. voice, text, chat, email)

Benefits

• Immediate reduction in administrative workload
• Faster patient flow & reduced bottlenecks
• Scalable operations without increasing staff
• Higher throughput with lower cost per case
• Improved accuracy, consistency, and compliance
• Better patient communication & experience
• Integration without disruption
• 24/7 availability with zero downtime
• Rapid deployment, modular adoption
• Human-in-the-loop governance

• Education pricing available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at l.eastwood@swordhealth.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

827959415977932

Contact

Luke Eastwood
07596496242
l.eastwood@swordhealth.com

About your service

• Service categories:

  Applications

  Production and operations

  Service industry and public sector operations

  • Healthcare
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: N/A
• System requirements: Flexible architecture works with any system. No specific requirements needed.

User support

• Email or online ticketing support: Yes
• Support response times: Response times vary based on severity: critical issues are addressed immediately, while standard queries typically receive responses within 1-2 business days. We prioritise based on impact to ensure urgent matters get immediate attention.
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes
• Support levels: We provide comprehensive support designed to scale with your deployment needs. All clients receive our Standard Support, which includes email support during business hours (Monday-Friday, 9am-5pm GMT), with response times based on severity levels. Critical and High severity incidents receive 24/7 support with 2-4 hour response targets, ensuring urgent production issues are addressed immediately regardless of time or day. Medium and Low severity issues are handled within 1-3 business days.; ; Every client is assigned a dedicated Technical Account Manager who serves as your primary point of contact throughout deployment and ongoing operations, supported by our team of support engineers who handle technical escalations, infrastructure issues, and performance optimisation. For larger deployments or system-wide implementations, we work with you to define tailored support arrangements that align with your operational requirements and governance processes.; ; Support is included as part of the core service—there are no separate support tiers or additional costs. Our platform maintains 99.5% uptime, with planned maintenance limited to 4 hours monthly and communicated 48 hours in advance. This approach ensures you receive responsive, white-glove support from day one without complex pricing structures or coverage gaps.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: All customers receive tailored onboarding and documentation based on their specific deployment, which may include setup guides, configuration guidance, operational support materials, and technical documentation where relevant. These resources are designed for both technical and clinical/operational users, ensuring teams understand how the service integrates into their workflows.; ; For live services or larger deployments, we provide guided onboarding sessions to support initial setup, configuration, and testing. These sessions are typically delivered remotely and involve technical leads, service owners, and relevant clinical or operational stakeholders. Where needed, we can also provide tailored training for administrators or frontline users, covering day-to-day operations, governance, and change management.; ; For complex or system-wide implementations, onsite support and in-person training can be arranged. Ongoing support is available throughout rollout to ensure users are confident and able to adopt the service safely and effectively.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • ODF
  • PDF
• End-of-contract data extraction: Data extraction processes are discussed and agreed during contract negotiations to ensure they align with your technical environment, data governance requirements, and operational needs. We work collaboratively to ensure a smooth transition.
• End-of-contract process: End-of-contract arrangements, including data extraction, transition support, and any associated costs, are negotiated on a per-contract basis to reflect the specific scope, complexity, and requirements of each deployment.
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
• Application to install: No
• Designed for use on mobile devices: No
• Service interface: Yes
• User support accessibility: WCAG 2.2 AA
• Description of service interface: Yes, via web browser and integration within existing clinical systems as needed.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: In house testing as part of design and development process
• API: Yes
• What users can and can't do using the API: Yes. Our platform includes APIs that enable integration with existing NHS systems including EPRs, PAS, and third-party applications. API availability and specifications are defined collaboratively during the deployment planning phase to ensure seamless integration with your specific technical environment.
• API documentation: Yes
• API documentation formats: PDF
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: Our AI agents are designed to be fully tailored to your workflows, SOPs, and policies. This includes triage pathways and routing rules, conversation flows and messaging, operating hours and escalation logic, integration points with your existing systems, and reporting outputs. The platform adapts to your local services, referral options, and operational requirements—not the other way around.; ; Straightforward configurations like operating hours, user permissions, and basic workflow rules can be adjusted directly through the platform interface by authorised users. More sophisticated customisations—such as complex routing logic, custom integrations, or clinical pathway modifications—are implemented collaboratively with our support engineering team to ensure safety and quality. All changes are version-controlled, tested before deployment, and can be rolled back if needed.; ; Customisation is a partnership between your designated administrators (system owners, clinical leads, operational managers) and our technical team. Role-based access controls ensure only authorised users can make changes, maintaining governance and accountability while giving you the flexibility to evolve the service as your needs change.

Scaling

• Independence of resources: We ensure individual users are not affected by other users’ demand primarily through elastic autoscaling of compute and supporting services, allowing capacity to expand dynamically as load increases, with per-user limits and rate controls applied only as safeguards in exceptional cases to protect overall service stability.

Analytics

• Service usage metrics: Yes
• Metrics types: Metrics are defined collaboratively based on your specific workflows and operational priorities. Common examples include referral completion rates, appointment booking success rates, no-show reduction, call handling times, patient engagement metrics, triage accuracy, and system availability. We can also provide clinical pathway metrics such as time-to-first-appointment or waiting list movements. All metrics are designed to support operational monitoring, quality improvement, and reporting requirements relevant to your deployment.
• Reporting types:
  • API access
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: Yes
• FOCUS resource tagging: Yes

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Developed Vetting (DV)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: Yes
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: Another external penetration testing organisation
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Encryption of all physical media
  • Scale, obfuscating techniques, or data storage sharding
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type: Deleted data can’t be directly accessed / Cryptographic Erasure

Data importing and exporting

• Data export approach: End users can obtain a copy of their personal data through a standard data subject access request process, with data provided in a commonly used, machine-readable format within statutory timelines, in line with UK GDPR requirements.
• Data export formats:
  • CSV
  • ODF
  • Other
• Data import formats:
  • CSV
  • ODF
  • Other

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • Private network or public sector network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: We guarantee a minimum service availability of 99.5% measured annually, supported by redundant architecture, continuous monitoring, and automated recovery, and if availability falls below this level, affected users are eligible for service credits in accordance with the agreed SLA.
• Approach to resilience: Available upon request
• Outage reporting: At minimum, all customers receive proactive email notifications for service outages or degradations. For Critical or High severity incidents, your dedicated Technical Account Manager will also reach out directly to ensure you're informed and updated throughout resolution. Where required, we can provide status updates via API or through a status dashboard to support your incident management processes.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Limited access network (for example PSN)
  • Dedicated link (for example VPN)
  • Username or password
• Access restrictions in management interfaces and support channels: Access to management interfaces and support channels is restricted using strong authentication and role-based access control, with least-privilege permissions, audit logging, and secure administrative access mechanisms to ensure only authorised users and support personnel can view or act on sensitive data and system functions.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
  • Identity federation with existing provider (for example Google Apps)
  • Dedicated link (for example VPN)

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards:
  • CSA CSM version 4.0
  • ISO/IEC 27001
• Information security policies and processes: Sword Health’s security programme is built on the HITRUST CSF and reviewed annually through HITRUST/SOC 2 audits. Policies span data classification, incident management, SDLC, vulnerability management and access control. The CISO approves and oversees these policies and leads the security and incident‑response teams; a Privacy Officer controls data disclosures. Staff must report incidents to the Information Security, Risk & Compliance team immediately, and the organisation enforces compliance through mandatory training, documented processes and sanctions for violations.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: All configuration and software changes are done using Infrastructure as Code and Configuration as Code. All code changes are tracked using Jira tickets and are subject to mandatory code reviews, testing, and approval by a team leader before production deployment. Additionally code security tools are embedded in the CI/CD pipeline.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: Vulnerabilities are identified at several levels:; - All code is subject to SAST and SCA analysis upon each code change; - All applications are subject to DAST scans on a periodic basis ; - All applications running in our cloud environment are monitored using CSPM and Vulnerability Management Tools; - Additional unauthenticated external vulnerability scans are in place for all our public-facing cloud endpoints
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: Logs from our cloud environment and relevant security and identity tools are aggregated and continuously analyzed for indicators of compromise.; ; When indicators of compromise are identified, a process exists to automatically and manually analyze it with defined escalation steps that can result in an incident being identified.; ; If an incident is identified, initial triage usually happens within hours (never more than 72h). It follows a defined incident response program which includes Detection and Analysis, Containment, Eradication, and Recovery, and Post-Incident Activity
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: Predefined processes for common events are in place.; Instructions for users to report incidents are part of the incident response policy which is communicated company-wide.; Incident reports are provided according to legal requirements and contractual requirements and may differ from client to client
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: Yes
• Connected networks:
  • Scottish Wide Area Network (SWAN)
  • Health and Social Care Network (HSCN)

Pricing

• Discount for educational organisations: Yes
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 0%
• Between £500,001 and £1,000,000: 0%
• Between £1,000,001 and £2,500,000: 0%
• Between £2,500,001 and £5,000,000: 0%
• Over £5,000,001: 0%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: No
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: No
• Cyber Essentials Alternative: In relation to the services you do not have a current and valid Cyber Essentials certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials certificate by one of the government approved accreditation bodies within 12 months of the date of award.
• Cyber essentials plus: No
• Cyber Essentials Alternative: None of the criteria
• Other security certifications: Yes
• Any other security certifications:
  • HITRUST CSF
  • SOC 2 Type II

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at l.eastwood@swordhealth.com. Tell them what format you need. It will help if you say what assistive technology you use.