Skip to main content

Help us improve the Digital Marketplace - send your feedback

ICS Operations Limited

Xyla Digital Therapies: Adult Services

Xyla Digital Therapies provides tailored, technology-based, one-to-one assessment and therapy for patients experiencing common mental health conditions such as anxiety and depression. Our patients can access therapy 7 days a week (7am-11pm) and can choose the time, language and communication method (video, audio or text) for their sessions.

Features

  • Remote, Technology-Based Therapy Solutions for patients
  • Extended opening hours of 07.00-23.00 7 days a week
  • Therapy available in 45+ languages
  • Quick access to assessment and treatment
  • Real time reporting of notes and clinical contacts
  • Quick set up and implementation of our service
  • Patient choice of online-messaging, online-audio, secure video
  • Pool of over 2,500 active therapists
  • Broad choice of brief therapies available
  • Scale up and down with agility

Benefits

  • Patients can book appointments around their availability (inc. Out-of-hours)
  • Enhanced patient experience which removes need/cost for interpreters
  • 81% quicker vs national targets, reducing deterioration and improving recovery
  • Provides clients with patient visibility and transparency of treatment
  • Provide immediate support in line with local challenges
  • Patients can take control of their care, improving engagement
  • Ability to scale quickly to support waitlist initiatives
  • Removing geographical boundaries ensures we match therapists to patients' needs

Pricing

£50 to £2,000 a user

Service documents

Request an accessible format
If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at bid.team@xyladigitaltherapies.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 14

Service ID

9 0 4 9 4 8 8 8 1 1 2 0 4 8 8

Contact

ICS Operations Limited Robert Taylor
Telephone: 0207 713 2757
Email: bid.team@xyladigitaltherapies.com

Service scope

Software add-on or extension
No
Cloud deployment model
Private cloud
Service constraints
We have clear support processes in place for clinical, administration, and technical queries. Operational hours are outlined and confirmed in service level agreements before a contract commences.

Scheduled maintenance may occur from technology partners, Mayden (iaptus) and Fuze. These Suppliers provide advanced notification of scheduled maintenance where appropriate, which often takes place outside of operational hours.

Therapy sessions are delivered through Maydens (iaptus).
System requirements
  • PC / VM Server
  • Iaptus
  • Email client
  • Telephone

User support

Email or online ticketing support
Email or online ticketing
Support response times
We resolve low-level issues within 24 working hours, medium-level issues in 48 working hours and technical issues within 14 working days.
User can manage status and priority of support tickets
No
Phone support
Yes
Phone support availability
9 to 5 (UK time), Monday to Friday
Web chat support
No
Onsite support
Yes, at extra cost
Support levels
We supply in and out of hours support with specific support processes in place for clinical, administration and technical queries.

Clinical: Clinical support is available between (8am – 8pm, Monday – Sunday), our clinical team are available for case management, clinical supervision and any risk management queries. Out of operational hours, a duty clinician is on-call for emergency escalations.

Administration: Available between 9am to 5.30pm Monday to Sunday

Technical: Available through internal infrastructure during operational hours, and through technology partners.

All support is included in the pricing.

There are clear points of contacts throughout engagement for any levels of support required.
Support available to third parties
Yes

Onboarding and offboarding

Getting started
Our Therapists provide accessible mental health services to patients referred to our service through a range of remote and digital methods.

We use systems already in use at NHS Trusts, and therefore minimal induction to our service is required for Trust staff.

Our therapists complete a rigorous selection process; they are specially recruited and asked to conduct a detailed online interview to determine competence. All our therapists are registered with the appropriate professional bodies.

All therapists are provided with one to one training on iaptus. This training is augmented with the use of a shared intranet where they can access documentation anytime, anywhere through a secured network as well as helpful guidelines and workflows. Therapists are also offered a monthly webinar where they can access real time support from one of our supervisors.

To support their ongoing clinical development, therapists receive weekly and monthly supervision and have access to a specific email address where they can ask questions 24/7. They are also able to access monthly webinars from our learning and development team which counts towards their regulatory bodies continual professional development and supports reaccreditation.
Service documentation
Yes
Documentation formats
  • HTML
  • PDF
End-of-contract data extraction
We discuss exit planning from the start of the service so that we can establish expectations and agree processes. We can export data in a standard csv format or PDF via secure email if required, however, all clients have full visibility of patient records through the secure integration of iaptus, eliminating the need to transfer data outside of the system. Alternative formats and processes may be available and can be discussed during contract negotiations.
End-of-contract process
We work to agreed contract terms, however, the nature of our contracts allow flexibility to upscale and downscale without notice, unless explicitly agreed from the outset. At the end of a contract, we simply cease to receive clinical data through iaptus, and cease to undertake any clinical services for the client.

All data is archived for the required period of 8 years through iaptus. This is included in the service we provide, and within the contract price.

Our service is designed to be easy-to-use and flexible. At contract end, client accounts can be deactivated immediately so there is no further data flow.
Customers only pay for referrals completed and processed through Xyla Digital Therapies, with no additional costs apart from DNAs and cancellations. Please see SLA for further information.

Using the service

Web browser interface
Yes
Supported browsers
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
  • Opera
Application to install
No
Designed for use on mobile devices
Yes
Differences between the mobile and desktop service
All parts of the service can be delivered through mobile devices. This includes a designated app for communications. Functionality is web-based, responsive and can change appearance and layout according to screen dimensions. There is no functionality that is hindered by using apps or mobile devices.
Service interface
No
User support accessibility
None or don’t know
API
No
Customisation available
Yes
Description of customisation
Xyla Digital Therapies is extremely flexible, and the service can be customised in multiple ways to meet local demand. We provide a range of services including assessment, low-intensity and high-intensity therapy. Our clients can choose to use parts of our service in isolation or in conjunction with others.

We provide our clients a choice in terms of how we communicate with their patients which includes audio, text, video and phone. In addition, this can be changed during treatment on a session by session basis by the patient.

Our clients are also able to select and request which languages they would like us to use to support their patients; this has been extremely well received by both patient and service, eliminating the cost of interpreters and increasing patient engagement.

We ensure we always work in close partnership with our clients and adapt our offering based on local needs. Prior to implementation we find out the local requirement, and through ongoing account management we ensure this evolves in line with service needs.

Scaling

Independence of resources
We can gain real-time visibility of our staffing levels across any timeframe using the capacity planning report and diary functions in iaptus. In addition to this, we review both monthly and historic IAPT data to capture seasonal trends which enables us to manage staff numbers proactively and effectively. Our staffing partner Pulse ensures we have access to over 2000 IAPT trained therapists. Pulse is well-established in recruitment and has an advanced compliance department; their speedy process allows us to be agile and effectively scale our workforce on demand.

Analytics

Service usage metrics
Yes
Metrics types
We can access and monitor granular pieces of information using iaptus, in line with the IAPT data set. This includes service performance, therapist performance, patient demographics and waiting times. Additional metrics we use to assess our service performance are:
- time into assessment
- time into treatment
- recovery rates
- reliable recovery
All of which currently exceed national targets and averages. We also monitor our therapists’ recovery rates on a weekly basis to ensure they are positively contributing to our overall goals and offer support through on going supervision and training.
Reporting types
  • Real-time dashboards
  • Regular reports
  • Reports on request

Resellers

Supplier type
Not a reseller

Staff security

Staff security clearance
Other security clearance
Government security clearance
Up to Baseline Personnel Security Standard (BPSS)

Asset protection

Knowledge of data storage and processing locations
Yes
Data storage and processing locations
United Kingdom
User control over data storage and processing locations
No
Datacentre security standards
Managed by a third party
Penetration testing frequency
At least once a year
Penetration testing approach
‘IT Health Check’ performed by a CHECK service provider
Protecting data at rest
Encryption of all physical media
Data sanitisation process
Yes
Data sanitisation type
Deleted data can’t be directly accessed
Equipment disposal approach
Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

Data export approach
Data export is completed securely via the infrastructure provider. Data export and reports are configured to meet user requirements as part of the implementation process.
Data export formats
  • CSV
  • ODF
  • Other
Other data export formats
  • Overnight extracts in the form of Tab-delimited text files
  • Extracts from reports delivered in .xls (Excel) or CSV files
Data import formats
Other
Other data import formats
It is not possible for users to import data

Data-in-transit protection

Data protection between buyer and supplier networks
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Other
Other protection between networks
WCAG 2.1AA, VPN, HSCN network connectivity
Data protection within supplier network
  • TLS (version 1.2 or above)
  • IPsec or TLS VPN gateway
  • Other
Other protection within supplier network
For backups, we follow a grandfather, father and son strategy using Veeam. A managed backup service is also in place which maintains offsite immutable backups.

In terms of access control, we operate on the basis of the principle of least privilege so that each user is granted the minimum system resources and authorisation required to perform their function.

In addition, we use a privilege access management (PAM) solution, Delinea for oversight and monitoring purposes.

MFA Enforced for all users

Availability and resilience

Guaranteed availability
From the outset of a new contract and during implementation, Xyla Digital Therapies agrees service delivery plans with technology partners to manage expectations around capabilities and service up-time. Given the nature of our service, and our clients’ needs, we remain agile and flexible in our approach. We do this through regular account management allowing us to forecast in advance the level of availability required to meet service demands. In addition to this, we have robust contingency plans that allow us to effectively adapt resources and functions to accommodate any last-minute changes that may arise. If we are unable to meet the demand of our clients, we do not charge for our service; it is only when a clinical contact has been completed that a charge applies.
Approach to resilience
This information is available on request.
Outage reporting
We communicate any issues clearly and quickly. Our onsite staff ensure reporting. We use email notifications to ensure ongoing communication throughout any outage.

Identity and authentication

User authentication needed
Yes
User authentication
  • 2-factor authentication
  • Username or password
  • Other
Other user authentication
User passwords:
Minimum length = 8.
2 step verification, Microsoft authenticator 2 step verification, username and password, pin and token to access case management system iaptus

Users cannot re-use the previous 5 passwords.
Expires after 90 days.
Locked out for 20 minutes after 5 unsuccessful attempts.

Utilises 2-factor authentication each time user logs in.
Access restrictions in management interfaces and support channels
User profiles and restrictions will determine level of access as provided and vetted. Access is controlled by Xyla Digital Therapies, so we can clearly define who has permission to clinical and sensitive information, and at what level. Different permissions can be granted depending on different levels of required access, and this is all controlled within the admin back-end of the system, centralised IT functions and IT partners. In addition, a monthly audit of user access rights is taken place by internal staff.
Access restriction testing frequency
At least every 6 months
Management access authentication
  • 2-factor authentication
  • Username or password
  • Other
Description of management access authentication
2 step verification, Microsoft authenticator 2 step verification, username and password, pin and token to access case management system iaptus

User passwords:
Minimum Length = 14.
Users cannot re-use the previous 5 passwords.
Expires after 30 days.
Locked out for 60 mins after 3 unsuccessful attempts.

Utilises 2-factor authentication each time user logs in

Audit information for users

Access to user activity audit information
Users have access to real-time audit information
How long user audit data is stored for
At least 12 months
Access to supplier activity audit information
Users have access to real-time audit information
How long supplier audit data is stored for
At least 12 months
How long system logs are stored for
At least 12 months

Standards and certifications

ISO/IEC 27001 certification
Yes
Who accredited the ISO/IEC 27001
ISOQAR Alcumus (previously QMS)
ISO/IEC 27001 accreditation date
12/06/2023 (previously 12/06/2013)
What the ISO/IEC 27001 doesn’t cover
Certification Scope: The management of information security in the provision of staffing services for the health,
social care & life sciences industries. This includes the provision of community and complex care services utilising digital solutions.
ISO 28000:2007 certification
No
CSA STAR certification
No
PCI certification
No
Cyber essentials
Yes
Cyber essentials plus
Yes
Other security certifications
No

Security governance

Named board-level person responsible for service security
Yes
Security governance certified
Yes
Security governance standards
  • ISO/IEC 27001
  • Other
Other security governance standards
Cyber Essentials Plus.

We oversee a security program with a clearly established governance structure. As part of that program, we maintain an Information Security Management System (ISMS) in line with our ISO27001 certification.
Information security policies and processes
Our robust suite of policies underpins our ISO27001, IG Toolkit and Cyber Essentials accreditation. Our Information Security Management System has processes for all governance and security aspects, including staff training, data protection and retention,
data transfer, hardware and access procedures.

Senior Managers (e.g. HR, IT, Operations) form our Information Governance committee, which reports to the Board, ensuring a whole-group and multi-role focus, and reviews performance and procedures.

Procedures for suspected/ actual information security incident (including near miss) mandate how each staff member should report, and what action is needed.

We record all incidents on Datix to ensure a consistent approach to collecting information, and mandatory steps ensure escalation to appropriate managers, and undertaking investigations within agreed timescales.

Our Clinical Director and Caldicott Guardian reports to ICO/ relevant third parties.

Information Governance committee reviews incidents to verify actions were appropriate and lessons are learned. To ensure policies are followed, all staff undertake training on Information Governance during induction, ensuring a baseline of knowledge.

Responsibility for Information Governance is included in staff code of conduct. This is reinforced by system protocols (e.g. mandatory password resets to approved complexity level). ISMS and documentation are available on intranet, not hard copy, ensuring version control.

Operational security

Configuration and change management standard
Supplier-defined controls
Configuration and change management approach
Changes are tracked in accordance with ISO27001. This ensures that all automated tests are run on every change as well as manual testing. Risk is assessed and any appropriate action taken to reduce risk to an acceptable level in accordance with our clinical risk policy.
Vulnerability management type
Supplier-defined controls
Vulnerability management approach
We conduct internal vulnerability assessments to assess the risk we expose our environment to. This is backed by Search Results Web results CVE - Common Vulnerabilities and Exposures (CVE) and National Vulnerability Database (NVD) security bulletins, delivered to us daily.

We utilise tools such as Qualys to conduct vulnerability scans of both our external facing infrastructure and internal infrastructure. We conduct penetration tests on our systems and applications at least annually and carry out remediation works based on the findings of the test. Internal processes facilitate the triage and patching process within 48 hours of a vulnerability being identified.
Protective monitoring type
Supplier-defined controls
Protective monitoring approach
Systems generate adequate audit events, forwarded into SIEM-solution, for effective identification of suspicious activity. Collected events are analysed within the SIEM by Security-Operation-Center.

Endpoint-protection on servers and endpoints with real time protection enabled. Updated regularly to contain active threats as they appear. Also creates an event/alarm into our SIEM.

When a potential compromise is discovered the information security team will investigate to determine if compromise is legitimate/active. Compromise is then isolated by revoking access and resetting password. Investigation then takes place to identify the initial vector and follow incident response process.

Incidents are prioritised, critical incidents are responded to immediately.
Incident management type
Supplier-defined controls
Incident management approach
Predefined process compliant with ISO72001-controls, coupled with Incident Response Policy.
SEIM-solution collates all information security events. Tuned to escalate alarms based on TTP/IOCs as well as anomalous patterns.
Reviewed by external SOC team who triage alerts to the Acacium Information security team for investigation.
Users can report incidents via Service-Desk-or-Information-Security-team which creates a ticket for investigation for the Analysis and Containment of any incidents.
Post-incident-review identifies lessons learnt and identifies opportunity for improvement, a post incident report is produced and given to relevant stakeholders and the board members.
Incident management process is regularly tested with tabletop exercises involving board members/technical-leads/incident-response-teams.

Secure development

Approach to secure software development best practice
Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v3.0)

Public sector networks

Connection to public sector networks
Yes
Connected networks
  • NHS Network (N3)
  • Other
Other public sector networks
NHS Spine

Social Value

Social Value

Social Value

  • Fighting climate change
  • Covid-19 recovery
  • Tackling economic inequality
  • Equal opportunity
  • Wellbeing

Fighting climate change

"Our Group-wide initiative, Champions of Change, focuses on reducing emissions, using energy efficient equipment, reducing waste, and providing sufficient employee training on the environment.

In line with our Carbon Reduction Plan and ISO:14001-accredited Environmental-Management-System, we will commit to the following initiatives, contributing positively towards your Net-Zero-Plan:

Reducing Emissions

• Offsetting unavoidable emissions through our Green Gas Certification Scheme
• Arranging site visits with clients in same region on same day
• Providing employees with our Cycle-to-Work Scheme
• Encouraging car-sharing amongst our employees by connecting colleagues across the business
• Promoting public transport options available to our employees when commuting
• Working with landlords to provide electric vehicle charging points in our offices
• Enabling as many of our employees as possible to work from home (c71% of our UK employees now work from home)

Energy Efficient Equipment

• Ensuring our offices continue to use 100% renewable and more energy efficient equipment. The number of desks in our offices using dual screens has been reduced and our higher energy consumption monitors have been replaced. Our 11th generation CPU laptops are more energy efficient
• Working with our landlords to improve reporting on emissions and influence decisions around energy choices

Reducing Waste

• The deployment, recovery and control of IT equipment will be managed through an improved asset management system.
• Our laptop suppliers, Dell, will continue to package and post equipment to us in recyclable materials.
• At the end of their lifecycle, technology assets will be passed onto disposal partners for recycling.
• Segregated waste/recycling bins will continue to be provided in our offices, in addition to posters and leaflets encouraging recycling.

Employee Training

• Ensuring our leadership team work with our ‘Green Champions’ to help employees reduce their carbon footprint
• Providing mandatory annual environmental-awareness course for employees"

Covid-19 recovery

We understand the long lasting impact which COVID-19 has had on local communities and we remain committed to supporting these communities in their recovery.

Throughout this contract, we will:

•Work with your stakeholders during mobilisation and during Contract Review Meetings to identify charities and organisations in the local area who were particularly affected by the impacts of COVID-19; providing them with our support.
•Adhere to all COVID safety protocols when we are required to be present on-site. This will include social distancing and wearing Personal Protective Equipment and face masks as appropriate.

Since the pandemic in 2020, we have worked extensively with our clients to deliver similar initiatives and tailor their service-models to support their rapidly-changing priorities.

This has included:

•The provision of various healthcare services for a wide range of NHS Trusts including Nightingale Hospitals (e.g., short-notice cover for staff sickness).
•Developed remote and digital services to support NHS Clinical Services and alleviate waiting-time pressures.
•One of our clients had amassed 300+ volunteers to support frontline workers but was struggling to manage this volume of volunteers. Therefore, we utilised our existing infrastructure to manage and schedule these volunteers, enhancing the effectiveness of their COVID-19 response. We also provided the client with additional marketing support through our in-house Marketing Team, ensuring they could attract further volunteers as required.
•As a government approved provider of COVID testing, we were instrumental in supporting universities with their student/staff testing-programmes (c.100,000 tests). We also delivered COVID vaccination programmes to NHS frontline staff and patients at NHS locations, Community Centres, and within Nightingale Pods. This included managing the complete workforce delivery of these venues.
•Supplied Life Sciences staff to pharmaceutical and clinical research organisations for vaccine development and trials.

Since January 2021, we have delivered:

•800,000+ covid tests
•19,000+ PoC tests
•30,000+ LFTs

Tackling economic inequality

Acknowledging the pressing significance of combatting economic inequality, our dedication to delivering innovative social value initiatives in this area will include:

Support in-work progression throughout our workforce, helping our employees move into higher-paid positions by developing their relevant skills: All our employees will continue to be provided with three-monthly appraisals, with objectives to meet their Continuous Professional Development requirements. Crucially, we will continue to use this time to discuss/facilitate additional skills/training. As well as mandatory training, we offer access to additional CPD courses, including 200+ RCNi-approved training modules, and quarterly regional training days, and more regardless of their protected characteristics (e.g., sex, age, disabilities, etc).
In-line with our five year Diversity and Inclusion Strategy, our Training Team will also conduct an annual training needs analysis to identify gaps in knowledge, skills, and competencies for our workforce, developing a personalised training and development plan for each employee, taking into account all protected characteristics, including any disabilities.

Further developing our understanding of in work progression issues which are affecting the market, industry, and sector: Our Insights team help us maintain an innate understanding of in-work progression issues, for our market/sector and within our organisation. We will continue to use this information to highlight areas of concern and best practice across the market, internally, and within this contract to review our policies and processes to ensure progression and development and pathways continue to be available across our workforce, including those facing the greatest inequalities.

Equal opportunity

We remain committed to maintaining a fair and equitable company culture that reflects the communities we serve. We have a dedicated Equality, Diversity, and Inclusion (EDI) Lead who strategizes with HR/leadership to achieve our EDI goals and provide expert guidance, and our Account Management Teams continue to work closely with our clients to review processes around recruitment, retention, pay, and development.

In line with our five year Diversity and Inclusion Strategy and EDI Policy, we will remain committed to:

EDI Training

Our mandatory equal opportunities training (on induction and annually) ensures employees demonstrate a thorough understanding of:

•Impact of discrimination, acknowledging complaints of bullying, harassment, victimisation, and discrimination are treated as misconduct.
•Importance of EDI and recent updates to our EDI Policy.
•How to:
o Encourage diverse experiences, backgrounds, knowledge, and skills to enrich our services.
o Create an environment of dignity, respect, and inclusion where individual differences and contributions are recognised and valued.
o Provide accessible services which respect individual needs and do not discriminate.

We also provide interactive EDI Workshops, with topics including ’Know your Bias’; helping employees understand how to promote equality in the workplace.

Inclusive Hiring

•Stating our (and our customer’s) commitment to equal opportunities on job advertisements.
•Recruitment Consultants check job advertisements for discriminatory language.
•Using Diversifying.io (a platform that advertises job vacancies) and local advertisement campaigns to reach underrepresented groups.

Fair Reward, Progression, and Recognition

•Reviewing our bonus schemes.
•Group-wide analysis of pay structures and grading (e.g., Annual Gender Pay Gap Reports).
•Three-monthly appraisals, additional CPD courses, quarterly regional training days, regardless of protected characteristics.
•Providing various programmes to promote equal opportunities. Recent examples:
o World Class Leaders Programme; 27 female colleagues took part, supporting our leaders at all levels to achieve academic and professional qualifications.
o Reverse-mentoring Programme for senior leaders.

Wellbeing

Our employee wellbeing approach is underpinned by four Wellbeing Pillars: Mental, Physical, Financial, and Social, supporting our employees in each of these areas.

Our initiatives across these areas will include:

Mental

•Providing all employees with access to our intranet's 'Wellbeing' section, featuring mental, financial, physical, and social resources, such as our 24/7 Employee Assistance Programme, online CBT, and mental health blog posts. Our sister-companies also include specialist mental-health recruiters and counselling-providers, providing an inbuilt openness towards mental-health conditions.
•Adding two Wellbeing Champions to our network per annum (accessible via our intranet) to provide more tailored support for employees’ and their mental health.

Physical

•Ensuring 100% of our workforce have access to our Wellness Calendar (e.g., team walks) and the various Health and Wellbeing Workshops which we run virtually, in-house, (e.g., virtual yoga classes), allowing them to stay fit and active during their normal working routine.
•Providing unlimited access to our various physical activity schemes, including ‘Acacium Running Club’ and ‘Cycle to Work Scheme’, ensuring physical activities are accessible to our entire workforce regardless of their preferences/requirements or location.

Financial

•Maintaining fair pay for 100% of our employees (in line with National Living Wage), reducing the physiological stresses of unequal paying conditions.
•Cost of Living Hub; We launched a dedicated intranet page to help employees access all our tools, resources, and information in one place. This includes money-saving tips, information on financial wellbeing, and links to other resources incorporated into the employee benefits package.

Social

•Ensuring our employees can join our Diversity and Inclusion Networks via our intranet and Diversity and Inclusion Leads.
•Providing our employees with two paid days of volunteering per annum, allowing them to take a break from their normal working week and de-stress.

Pricing

Price
£50 to £2,000 a user
Discount for educational organisations
No
Free trial available
No

Service documents

Request an accessible format
If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at bid.team@xyladigitaltherapies.com. Tell them what format you need. It will help if you say what assistive technology you use.