Xyla Digital Therapies: Adult Services
Xyla Digital Therapies provides tailored, technology-based, one-to-one assessment and therapy for patients experiencing common mental health conditions such as anxiety and depression. Our patients can access therapy 7 days a week (7am-11pm) and can choose the time, language and communication method (video, audio or text) for their sessions.
Features
- Remote, Technology-Based Therapy Solutions for patients
- Extended opening hours of 07.00-23.00 7 days a week
- Therapy available in 45+ languages
- Quick access to assessment and treatment
- Real time reporting of notes and clinical contacts
- Quick set up and implementation of our service
- Patient choice of online-messaging, online-audio, secure video
- Pool of over 2,500 active therapists
- Broad choice of brief therapies available
- Scale up and down with agility
Benefits
- Patients can book appointments around their availability (inc. Out-of-hours)
- Enhanced patient experience which removes need/cost for interpreters
- 81% quicker vs national targets, reducing deterioration and improving recovery
- Provides clients with patient visibility and transparency of treatment
- Provide immediate support in line with local challenges
- Patients can take control of their care, improving engagement
- Ability to scale quickly to support waitlist initiatives
- Removing geographical boundaries ensures we match therapists to patients' needs
Pricing
£50 to £2,000 a user
Service documents
Request an accessible format
Framework
G-Cloud 14
Service ID
9 0 4 9 4 8 8 8 1 1 2 0 4 8 8
Contact
ICS Operations Limited
Robert Taylor
Telephone: 0207 713 2757
Email: bid.team@xyladigitaltherapies.com
Service scope
- Software add-on or extension
- No
- Cloud deployment model
- Private cloud
- Service constraints
-
We have clear support processes in place for clinical, administration, and technical queries. Operational hours are outlined and confirmed in service level agreements before a contract commences.
Scheduled maintenance may occur from technology partners, Mayden (iaptus) and Fuze. These Suppliers provide advanced notification of scheduled maintenance where appropriate, which often takes place outside of operational hours.
Therapy sessions are delivered through Maydens (iaptus). - System requirements
-
- PC / VM Server
- Iaptus
- Email client
- Telephone
User support
- Email or online ticketing support
- Email or online ticketing
- Support response times
- We resolve low-level issues within 24 working hours, medium-level issues in 48 working hours and technical issues within 14 working days.
- User can manage status and priority of support tickets
- No
- Phone support
- Yes
- Phone support availability
- 9 to 5 (UK time), Monday to Friday
- Web chat support
- No
- Onsite support
- Yes, at extra cost
- Support levels
-
We supply in and out of hours support with specific support processes in place for clinical, administration and technical queries.
Clinical: Clinical support is available between (8am – 8pm, Monday – Sunday), our clinical team are available for case management, clinical supervision and any risk management queries. Out of operational hours, a duty clinician is on-call for emergency escalations.
Administration: Available between 9am to 5.30pm Monday to Sunday
Technical: Available through internal infrastructure during operational hours, and through technology partners.
All support is included in the pricing.
There are clear points of contacts throughout engagement for any levels of support required. - Support available to third parties
- Yes
Onboarding and offboarding
- Getting started
-
Our Therapists provide accessible mental health services to patients referred to our service through a range of remote and digital methods.
We use systems already in use at NHS Trusts, and therefore minimal induction to our service is required for Trust staff.
Our therapists complete a rigorous selection process; they are specially recruited and asked to conduct a detailed online interview to determine competence. All our therapists are registered with the appropriate professional bodies.
All therapists are provided with one to one training on iaptus. This training is augmented with the use of a shared intranet where they can access documentation anytime, anywhere through a secured network as well as helpful guidelines and workflows. Therapists are also offered a monthly webinar where they can access real time support from one of our supervisors.
To support their ongoing clinical development, therapists receive weekly and monthly supervision and have access to a specific email address where they can ask questions 24/7. They are also able to access monthly webinars from our learning and development team which counts towards their regulatory bodies continual professional development and supports reaccreditation. - Service documentation
- Yes
- Documentation formats
-
- HTML
- End-of-contract data extraction
- We discuss exit planning from the start of the service so that we can establish expectations and agree processes. We can export data in a standard csv format or PDF via secure email if required, however, all clients have full visibility of patient records through the secure integration of iaptus, eliminating the need to transfer data outside of the system. Alternative formats and processes may be available and can be discussed during contract negotiations.
- End-of-contract process
-
We work to agreed contract terms, however, the nature of our contracts allow flexibility to upscale and downscale without notice, unless explicitly agreed from the outset. At the end of a contract, we simply cease to receive clinical data through iaptus, and cease to undertake any clinical services for the client.
All data is archived for the required period of 8 years through iaptus. This is included in the service we provide, and within the contract price.
Our service is designed to be easy-to-use and flexible. At contract end, client accounts can be deactivated immediately so there is no further data flow.
Customers only pay for referrals completed and processed through Xyla Digital Therapies, with no additional costs apart from DNAs and cancellations. Please see SLA for further information.
Using the service
- Web browser interface
- Yes
- Supported browsers
-
- Microsoft Edge
- Firefox
- Chrome
- Safari
- Opera
- Application to install
- No
- Designed for use on mobile devices
- Yes
- Differences between the mobile and desktop service
- All parts of the service can be delivered through mobile devices. This includes a designated app for communications. Functionality is web-based, responsive and can change appearance and layout according to screen dimensions. There is no functionality that is hindered by using apps or mobile devices.
- Service interface
- No
- User support accessibility
- None or don’t know
- API
- No
- Customisation available
- Yes
- Description of customisation
-
Xyla Digital Therapies is extremely flexible, and the service can be customised in multiple ways to meet local demand. We provide a range of services including assessment, low-intensity and high-intensity therapy. Our clients can choose to use parts of our service in isolation or in conjunction with others.
We provide our clients a choice in terms of how we communicate with their patients which includes audio, text, video and phone. In addition, this can be changed during treatment on a session by session basis by the patient.
Our clients are also able to select and request which languages they would like us to use to support their patients; this has been extremely well received by both patient and service, eliminating the cost of interpreters and increasing patient engagement.
We ensure we always work in close partnership with our clients and adapt our offering based on local needs. Prior to implementation we find out the local requirement, and through ongoing account management we ensure this evolves in line with service needs.
Scaling
- Independence of resources
- We can gain real-time visibility of our staffing levels across any timeframe using the capacity planning report and diary functions in iaptus. In addition to this, we review both monthly and historic IAPT data to capture seasonal trends which enables us to manage staff numbers proactively and effectively. Our staffing partner Pulse ensures we have access to over 2000 IAPT trained therapists. Pulse is well-established in recruitment and has an advanced compliance department; their speedy process allows us to be agile and effectively scale our workforce on demand.
Analytics
- Service usage metrics
- Yes
- Metrics types
-
We can access and monitor granular pieces of information using iaptus, in line with the IAPT data set. This includes service performance, therapist performance, patient demographics and waiting times. Additional metrics we use to assess our service performance are:
- time into assessment
- time into treatment
- recovery rates
- reliable recovery
All of which currently exceed national targets and averages. We also monitor our therapists’ recovery rates on a weekly basis to ensure they are positively contributing to our overall goals and offer support through on going supervision and training. - Reporting types
-
- Real-time dashboards
- Regular reports
- Reports on request
Resellers
- Supplier type
- Not a reseller
Staff security
- Staff security clearance
- Other security clearance
- Government security clearance
- Up to Baseline Personnel Security Standard (BPSS)
Asset protection
- Knowledge of data storage and processing locations
- Yes
- Data storage and processing locations
- United Kingdom
- User control over data storage and processing locations
- No
- Datacentre security standards
- Managed by a third party
- Penetration testing frequency
- At least once a year
- Penetration testing approach
- ‘IT Health Check’ performed by a CHECK service provider
- Protecting data at rest
- Encryption of all physical media
- Data sanitisation process
- Yes
- Data sanitisation type
- Deleted data can’t be directly accessed
- Equipment disposal approach
- Complying with a recognised standard, for example CSA CCM v.30, CAS (Sanitisation) or ISO/IEC 27001
Data importing and exporting
- Data export approach
- Data export is completed securely via the infrastructure provider. Data export and reports are configured to meet user requirements as part of the implementation process.
- Data export formats
-
- CSV
- ODF
- Other
- Other data export formats
-
- Overnight extracts in the form of Tab-delimited text files
- Extracts from reports delivered in .xls (Excel) or CSV files
- Data import formats
- Other
- Other data import formats
- It is not possible for users to import data
Data-in-transit protection
- Data protection between buyer and supplier networks
-
- TLS (version 1.2 or above)
- IPsec or TLS VPN gateway
- Other
- Other protection between networks
- WCAG 2.1AA, VPN, HSCN network connectivity
- Data protection within supplier network
-
- TLS (version 1.2 or above)
- IPsec or TLS VPN gateway
- Other
- Other protection within supplier network
-
For backups, we follow a grandfather, father and son strategy using Veeam. A managed backup service is also in place which maintains offsite immutable backups.
In terms of access control, we operate on the basis of the principle of least privilege so that each user is granted the minimum system resources and authorisation required to perform their function.
In addition, we use a privilege access management (PAM) solution, Delinea for oversight and monitoring purposes.
MFA Enforced for all users
Availability and resilience
- Guaranteed availability
- From the outset of a new contract and during implementation, Xyla Digital Therapies agrees service delivery plans with technology partners to manage expectations around capabilities and service up-time. Given the nature of our service, and our clients’ needs, we remain agile and flexible in our approach. We do this through regular account management allowing us to forecast in advance the level of availability required to meet service demands. In addition to this, we have robust contingency plans that allow us to effectively adapt resources and functions to accommodate any last-minute changes that may arise. If we are unable to meet the demand of our clients, we do not charge for our service; it is only when a clinical contact has been completed that a charge applies.
- Approach to resilience
- This information is available on request.
- Outage reporting
- We communicate any issues clearly and quickly. Our onsite staff ensure reporting. We use email notifications to ensure ongoing communication throughout any outage.
Identity and authentication
- User authentication needed
- Yes
- User authentication
-
- 2-factor authentication
- Username or password
- Other
- Other user authentication
-
User passwords:
Minimum length = 8.
2 step verification, Microsoft authenticator 2 step verification, username and password, pin and token to access case management system iaptus
Users cannot re-use the previous 5 passwords.
Expires after 90 days.
Locked out for 20 minutes after 5 unsuccessful attempts.
Utilises 2-factor authentication each time user logs in. - Access restrictions in management interfaces and support channels
- User profiles and restrictions will determine level of access as provided and vetted. Access is controlled by Xyla Digital Therapies, so we can clearly define who has permission to clinical and sensitive information, and at what level. Different permissions can be granted depending on different levels of required access, and this is all controlled within the admin back-end of the system, centralised IT functions and IT partners. In addition, a monthly audit of user access rights is taken place by internal staff.
- Access restriction testing frequency
- At least every 6 months
- Management access authentication
-
- 2-factor authentication
- Username or password
- Other
- Description of management access authentication
-
2 step verification, Microsoft authenticator 2 step verification, username and password, pin and token to access case management system iaptus
User passwords:
Minimum Length = 14.
Users cannot re-use the previous 5 passwords.
Expires after 30 days.
Locked out for 60 mins after 3 unsuccessful attempts.
Utilises 2-factor authentication each time user logs in
Audit information for users
- Access to user activity audit information
- Users have access to real-time audit information
- How long user audit data is stored for
- At least 12 months
- Access to supplier activity audit information
- Users have access to real-time audit information
- How long supplier audit data is stored for
- At least 12 months
- How long system logs are stored for
- At least 12 months
Standards and certifications
- ISO/IEC 27001 certification
- Yes
- Who accredited the ISO/IEC 27001
- ISOQAR Alcumus (previously QMS)
- ISO/IEC 27001 accreditation date
- 12/06/2023 (previously 12/06/2013)
- What the ISO/IEC 27001 doesn’t cover
-
Certification Scope: The management of information security in the provision of staffing services for the health,
social care & life sciences industries. This includes the provision of community and complex care services utilising digital solutions. - ISO 28000:2007 certification
- No
- CSA STAR certification
- No
- PCI certification
- No
- Cyber essentials
- Yes
- Cyber essentials plus
- Yes
- Other security certifications
- No
Security governance
- Named board-level person responsible for service security
- Yes
- Security governance certified
- Yes
- Security governance standards
-
- ISO/IEC 27001
- Other
- Other security governance standards
-
Cyber Essentials Plus.
We oversee a security program with a clearly established governance structure. As part of that program, we maintain an Information Security Management System (ISMS) in line with our ISO27001 certification. - Information security policies and processes
-
Our robust suite of policies underpins our ISO27001, IG Toolkit and Cyber Essentials accreditation. Our Information Security Management System has processes for all governance and security aspects, including staff training, data protection and retention,
data transfer, hardware and access procedures.
Senior Managers (e.g. HR, IT, Operations) form our Information Governance committee, which reports to the Board, ensuring a whole-group and multi-role focus, and reviews performance and procedures.
Procedures for suspected/ actual information security incident (including near miss) mandate how each staff member should report, and what action is needed.
We record all incidents on Datix to ensure a consistent approach to collecting information, and mandatory steps ensure escalation to appropriate managers, and undertaking investigations within agreed timescales.
Our Clinical Director and Caldicott Guardian reports to ICO/ relevant third parties.
Information Governance committee reviews incidents to verify actions were appropriate and lessons are learned. To ensure policies are followed, all staff undertake training on Information Governance during induction, ensuring a baseline of knowledge.
Responsibility for Information Governance is included in staff code of conduct. This is reinforced by system protocols (e.g. mandatory password resets to approved complexity level). ISMS and documentation are available on intranet, not hard copy, ensuring version control.
Operational security
- Configuration and change management standard
- Supplier-defined controls
- Configuration and change management approach
- Changes are tracked in accordance with ISO27001. This ensures that all automated tests are run on every change as well as manual testing. Risk is assessed and any appropriate action taken to reduce risk to an acceptable level in accordance with our clinical risk policy.
- Vulnerability management type
- Supplier-defined controls
- Vulnerability management approach
-
We conduct internal vulnerability assessments to assess the risk we expose our environment to. This is backed by Search Results Web results CVE - Common Vulnerabilities and Exposures (CVE) and National Vulnerability Database (NVD) security bulletins, delivered to us daily.
We utilise tools such as Qualys to conduct vulnerability scans of both our external facing infrastructure and internal infrastructure. We conduct penetration tests on our systems and applications at least annually and carry out remediation works based on the findings of the test. Internal processes facilitate the triage and patching process within 48 hours of a vulnerability being identified. - Protective monitoring type
- Supplier-defined controls
- Protective monitoring approach
-
Systems generate adequate audit events, forwarded into SIEM-solution, for effective identification of suspicious activity. Collected events are analysed within the SIEM by Security-Operation-Center.
Endpoint-protection on servers and endpoints with real time protection enabled. Updated regularly to contain active threats as they appear. Also creates an event/alarm into our SIEM.
When a potential compromise is discovered the information security team will investigate to determine if compromise is legitimate/active. Compromise is then isolated by revoking access and resetting password. Investigation then takes place to identify the initial vector and follow incident response process.
Incidents are prioritised, critical incidents are responded to immediately. - Incident management type
- Supplier-defined controls
- Incident management approach
-
Predefined process compliant with ISO72001-controls, coupled with Incident Response Policy.
SEIM-solution collates all information security events. Tuned to escalate alarms based on TTP/IOCs as well as anomalous patterns.
Reviewed by external SOC team who triage alerts to the Acacium Information security team for investigation.
Users can report incidents via Service-Desk-or-Information-Security-team which creates a ticket for investigation for the Analysis and Containment of any incidents.
Post-incident-review identifies lessons learnt and identifies opportunity for improvement, a post incident report is produced and given to relevant stakeholders and the board members.
Incident management process is regularly tested with tabletop exercises involving board members/technical-leads/incident-response-teams.
Secure development
- Approach to secure software development best practice
- Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v3.0)
Public sector networks
- Connection to public sector networks
- Yes
- Connected networks
-
- NHS Network (N3)
- Other
- Other public sector networks
- NHS Spine
Social Value
- Social Value
-
Social Value
- Fighting climate change
- Covid-19 recovery
- Tackling economic inequality
- Equal opportunity
- Wellbeing
Fighting climate change
"Our Group-wide initiative, Champions of Change, focuses on reducing emissions, using energy efficient equipment, reducing waste, and providing sufficient employee training on the environment.
In line with our Carbon Reduction Plan and ISO:14001-accredited Environmental-Management-System, we will commit to the following initiatives, contributing positively towards your Net-Zero-Plan:
Reducing Emissions
• Offsetting unavoidable emissions through our Green Gas Certification Scheme
• Arranging site visits with clients in same region on same day
• Providing employees with our Cycle-to-Work Scheme
• Encouraging car-sharing amongst our employees by connecting colleagues across the business
• Promoting public transport options available to our employees when commuting
• Working with landlords to provide electric vehicle charging points in our offices
• Enabling as many of our employees as possible to work from home (c71% of our UK employees now work from home)
Energy Efficient Equipment
• Ensuring our offices continue to use 100% renewable and more energy efficient equipment. The number of desks in our offices using dual screens has been reduced and our higher energy consumption monitors have been replaced. Our 11th generation CPU laptops are more energy efficient
• Working with our landlords to improve reporting on emissions and influence decisions around energy choices
Reducing Waste
• The deployment, recovery and control of IT equipment will be managed through an improved asset management system.
• Our laptop suppliers, Dell, will continue to package and post equipment to us in recyclable materials.
• At the end of their lifecycle, technology assets will be passed onto disposal partners for recycling.
• Segregated waste/recycling bins will continue to be provided in our offices, in addition to posters and leaflets encouraging recycling.
Employee Training
• Ensuring our leadership team work with our ‘Green Champions’ to help employees reduce their carbon footprint
• Providing mandatory annual environmental-awareness course for employees"Covid-19 recovery
We understand the long lasting impact which COVID-19 has had on local communities and we remain committed to supporting these communities in their recovery.
Throughout this contract, we will:
•Work with your stakeholders during mobilisation and during Contract Review Meetings to identify charities and organisations in the local area who were particularly affected by the impacts of COVID-19; providing them with our support.
•Adhere to all COVID safety protocols when we are required to be present on-site. This will include social distancing and wearing Personal Protective Equipment and face masks as appropriate.
Since the pandemic in 2020, we have worked extensively with our clients to deliver similar initiatives and tailor their service-models to support their rapidly-changing priorities.
This has included:
•The provision of various healthcare services for a wide range of NHS Trusts including Nightingale Hospitals (e.g., short-notice cover for staff sickness).
•Developed remote and digital services to support NHS Clinical Services and alleviate waiting-time pressures.
•One of our clients had amassed 300+ volunteers to support frontline workers but was struggling to manage this volume of volunteers. Therefore, we utilised our existing infrastructure to manage and schedule these volunteers, enhancing the effectiveness of their COVID-19 response. We also provided the client with additional marketing support through our in-house Marketing Team, ensuring they could attract further volunteers as required.
•As a government approved provider of COVID testing, we were instrumental in supporting universities with their student/staff testing-programmes (c.100,000 tests). We also delivered COVID vaccination programmes to NHS frontline staff and patients at NHS locations, Community Centres, and within Nightingale Pods. This included managing the complete workforce delivery of these venues.
•Supplied Life Sciences staff to pharmaceutical and clinical research organisations for vaccine development and trials.
Since January 2021, we have delivered:
•800,000+ covid tests
•19,000+ PoC tests
•30,000+ LFTsTackling economic inequality
Acknowledging the pressing significance of combatting economic inequality, our dedication to delivering innovative social value initiatives in this area will include:
Support in-work progression throughout our workforce, helping our employees move into higher-paid positions by developing their relevant skills: All our employees will continue to be provided with three-monthly appraisals, with objectives to meet their Continuous Professional Development requirements. Crucially, we will continue to use this time to discuss/facilitate additional skills/training. As well as mandatory training, we offer access to additional CPD courses, including 200+ RCNi-approved training modules, and quarterly regional training days, and more regardless of their protected characteristics (e.g., sex, age, disabilities, etc).
In-line with our five year Diversity and Inclusion Strategy, our Training Team will also conduct an annual training needs analysis to identify gaps in knowledge, skills, and competencies for our workforce, developing a personalised training and development plan for each employee, taking into account all protected characteristics, including any disabilities.
Further developing our understanding of in work progression issues which are affecting the market, industry, and sector: Our Insights team help us maintain an innate understanding of in-work progression issues, for our market/sector and within our organisation. We will continue to use this information to highlight areas of concern and best practice across the market, internally, and within this contract to review our policies and processes to ensure progression and development and pathways continue to be available across our workforce, including those facing the greatest inequalities.Equal opportunity
We remain committed to maintaining a fair and equitable company culture that reflects the communities we serve. We have a dedicated Equality, Diversity, and Inclusion (EDI) Lead who strategizes with HR/leadership to achieve our EDI goals and provide expert guidance, and our Account Management Teams continue to work closely with our clients to review processes around recruitment, retention, pay, and development.
In line with our five year Diversity and Inclusion Strategy and EDI Policy, we will remain committed to:
EDI Training
Our mandatory equal opportunities training (on induction and annually) ensures employees demonstrate a thorough understanding of:
•Impact of discrimination, acknowledging complaints of bullying, harassment, victimisation, and discrimination are treated as misconduct.
•Importance of EDI and recent updates to our EDI Policy.
•How to:
o Encourage diverse experiences, backgrounds, knowledge, and skills to enrich our services.
o Create an environment of dignity, respect, and inclusion where individual differences and contributions are recognised and valued.
o Provide accessible services which respect individual needs and do not discriminate.
We also provide interactive EDI Workshops, with topics including ’Know your Bias’; helping employees understand how to promote equality in the workplace.
Inclusive Hiring
•Stating our (and our customer’s) commitment to equal opportunities on job advertisements.
•Recruitment Consultants check job advertisements for discriminatory language.
•Using Diversifying.io (a platform that advertises job vacancies) and local advertisement campaigns to reach underrepresented groups.
Fair Reward, Progression, and Recognition
•Reviewing our bonus schemes.
•Group-wide analysis of pay structures and grading (e.g., Annual Gender Pay Gap Reports).
•Three-monthly appraisals, additional CPD courses, quarterly regional training days, regardless of protected characteristics.
•Providing various programmes to promote equal opportunities. Recent examples:
o World Class Leaders Programme; 27 female colleagues took part, supporting our leaders at all levels to achieve academic and professional qualifications.
o Reverse-mentoring Programme for senior leaders.Wellbeing
Our employee wellbeing approach is underpinned by four Wellbeing Pillars: Mental, Physical, Financial, and Social, supporting our employees in each of these areas.
Our initiatives across these areas will include:
Mental
•Providing all employees with access to our intranet's 'Wellbeing' section, featuring mental, financial, physical, and social resources, such as our 24/7 Employee Assistance Programme, online CBT, and mental health blog posts. Our sister-companies also include specialist mental-health recruiters and counselling-providers, providing an inbuilt openness towards mental-health conditions.
•Adding two Wellbeing Champions to our network per annum (accessible via our intranet) to provide more tailored support for employees’ and their mental health.
Physical
•Ensuring 100% of our workforce have access to our Wellness Calendar (e.g., team walks) and the various Health and Wellbeing Workshops which we run virtually, in-house, (e.g., virtual yoga classes), allowing them to stay fit and active during their normal working routine.
•Providing unlimited access to our various physical activity schemes, including ‘Acacium Running Club’ and ‘Cycle to Work Scheme’, ensuring physical activities are accessible to our entire workforce regardless of their preferences/requirements or location.
Financial
•Maintaining fair pay for 100% of our employees (in line with National Living Wage), reducing the physiological stresses of unequal paying conditions.
•Cost of Living Hub; We launched a dedicated intranet page to help employees access all our tools, resources, and information in one place. This includes money-saving tips, information on financial wellbeing, and links to other resources incorporated into the employee benefits package.
Social
•Ensuring our employees can join our Diversity and Inclusion Networks via our intranet and Diversity and Inclusion Leads.
•Providing our employees with two paid days of volunteering per annum, allowing them to take a break from their normal working week and de-stress.
Pricing
- Price
- £50 to £2,000 a user
- Discount for educational organisations
- No
- Free trial available
- No