VISIBA UK LIMITED

Visiba Triage

Visiba Triage is a market-leading AI-enabled triage tool. It is a Class IIA medical device, that conducts patient assessments and surfaces clinical urgency and differential diagnoses to healthcare professionals. It includes configurable levels of automation as well as live integration with core healthcare software.

Features

• AI-enabled triage solution (Visiba Triage powered by Red Robin)
• Intelligently takes patient history for new symptoms
• Provides HCPs with urgency rating based on Manchester Triage Scale
• Provides differential diagnoses and probability
• Supports integrated care, primary care and secondary care services
• Intelligent navigation tool

Benefits

• Intelligent navigation of patients
• Ease pressure on busy services
• Reduce inbound telephone calls
• Free up clinical time
• Reduce administration
• Hold more efficient and informed consultations
• Reduce waiting lists and backlogs
• Guide patients to right level of care at right time
• Provide a patient-friendly app with superior user-experience

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at contact@visibagroup.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

909172225947847

Contact

Hannah Gibson
07725723438
contact@visibagroup.com

About your service

• Service categories:

  Applications

  Production and operations

  Service industry and public sector operations

  • Healthcare
• Multi cloud support: No

Service scope

• Software add-on or extension: Yes, but can also be used as a standalone service
• What software services is the service an extension to: Clinical systems (electronic health records, patient management systems); ; Access & communication systems (telephony, digital front door platforms, patient portals and apps); ; Operational infrastructure (workforce management systems)
• Cloud deployment model: Hybrid cloud
• Service constraints: Provider may perform scheduled maintenance of the Service at a mutually agreed time with the provider.
• System requirements:
  • Security and compliance documentation
  • Infrastructure requirements (computer with web browser)
  • Authentication process (such as single sign on)
  • Operational requirements (such as user training and user-level-access)

User support

• Email or online ticketing support: Yes
• Support response times: Severity Level : Critical; Response Time : 15 minutes; Temporary Resolution Time : 6 hours; Final Resolution Time: 7 days; ; Severity Level : Major; Response Time : 30 minutes; Temporary Resolution Time : 14 hours; Final Resolution Time: 15 days; ; Severity Level : Minor; Response Time : 60 minutes; Temporary Resolution Time : -; Final Resolution Time: 60 days
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 24 hours, 7 days a week
• Web chat support: Yes
• Web chat support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support accessibility standard: WCAG 2.2 A
• Web chat accessibility testing: N/A
• Onsite support: Yes
• Support levels: The onboarding process is managed by a dedicated Account Manager. A Gantt Chart, detailing the requirements for successful service launch and delivery will be agreed by a representative from all parties, with timelines and milestones mutually agreed and resource ringfenced.; ; For system users, bespoke in-person and virtual training will be mutually agreed to meet the needs of the professional users at the beginning of the contract and throughout the contract duration, as needed. Training is delivered and tailored to the user’s needs, i.e. are they an Administrator or Healthcare Professional.; ; Documentation such as training manuals and video guides are also available in the solution itself, via the Visiba Helpcentre and can be easily accessed by healthcare professionals.
• Support available to third parties: Yes
• AI chatbot: No

Onboarding and offboarding

• Getting started: We provide partners with a detailed onboarding document to set expectations and support resource allocation for mobilisation. This is complemented by a flexible training programme and ongoing support from our Customer Success Team.; ; Every site has a bespoke onboarding plan which is developed in collaboration with our Customer Success Manager and incorporates elements including set-up meeting, training, identifying/developing marketing material/engagement techniques, creating practice users, pre- go-live checks, help and support.; ; Mobilisation includes training the healthcare professional users. Trainees attend one scenario-based workshop held by our training specialist. Each classroom workshop is intended for 10-15 trainees. The second stage includes e-learning and webinar follow-up education. The training programme is defined in collaboration with individual sites. End-users receive in-person (online/face-to-face) or e-learning training (2-6 hours dependent on requirements/method chosen), 2-4 weeks before the deployment of the service. Pre-recorded videos support training by demonstrating clinical/administrative tasks. Q&A sessions are held either in-person or remotely to test/support learning and specific workshops can be held to explain how our solution can be further optimised/staff can streamline existing practice processes/systems.
• Service documentation: Yes
• Documentation formats:
  • ODF
  • PDF
• End-of-contract data extraction: Export procedure:; All customer data is exported or deleted per the data controller's instructions. The customer specifies which datasets to extract, required formats, and timeline.; ; Data formats:; Extracted data is provided in structured formats suitable for import into alternative systems, maintaining integrity and readability.; ; Cost and timeline:; No additional charges apply. Timelines are agreed collaboratively during the offboarding process.; ; Verification:; The data controller receives confirmation of successful export and can verify completeness before final system access terminates. Post-export, data is deleted according to agreed retention schedules.
• End-of-contract process: Visiba project-manages offboarding through the Customer Success Manager, establishing a structured transition plan. All customer data is exported or deleted per the data controller's instructions, typically within 30 days of termination.; ; Final steps:; The data controller verifies export completeness before final system access terminates. Data is retained only until export completion, then deleted according to agreed schedules.; ; End of contract costs:; The following is included at no additional charge;; - Offboarding project management; - Data export/repatriation; - Transition planning support
• Documentation accessibility standard: WCAG 2.2 AA

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
• Application to install: No
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Not applicable.
• Service interface: Yes
• User support accessibility: WCAG 2.2 AA
• Description of service interface: Patient-facing and provider-facing interfaces:; Patients are able to access the solution via a mobile phone or tablet that is running the iOS or Android (with Google Play services installed) operating systems. The service is guaranteed to be compatible with the three latest major versions of iOS and Android.; ; Alternatively they can access the solution via Google Chrome, Firefox, Microsoft Edge and Apple Safari browsers. We guarantee support for versions up to 12 months old.; ; Healthcare professionals use a web-based portal to review completed triage cases with patient history, urgency ratings, and differential diagnoses.
• Accessibility standards: WCAG 2.2 AA
• Accessibility testing: We have conducted several audits to confirm that the content and functionality of the Visiba platform is WCAG 2.1 AA compliant. For example, in 2025, we performed accessibility testing of all interfaces of the Visiba platform (both healthcare professional and patient/client interfaces). The testing was performed by our Quality Assurance Team and real users with accessibility challenges. During the review process, this team used JAWS, NVDA, TalkBack and VoiceOver as tools and the users with visual impairments used JAWS and zooming tools. The review followed the NHS WCAG checklist. All new functionality designed by the Product Development Teams undergoes analysis from an accessibility standpoint. To ensure new features are usable in practice, our Quality Assurance Team tests the platform using the same accessibility tools that actual users will be using. We conduct user testing in several stages of product development. Early concept testing is performed when different solutions to a problem are being evaluated and compared to each other to select the most appropriate. The selected solution is then refined and tested again with a clickable prototype. The person testing is observed while performing tasks and gives feedback. The concept is evaluated on how easily the user performs the tasks.
• API: Yes
• What users can and can't do using the API: Visiba is committed since our founding of the company to an Open API policy and our API documentation can be found online - https://docs.visibatriage.com/api . All the core functions are available via the Open API. We have today multiple Commissioners and Consumers using our Open API to develop integrations between systems with more than 20 integrations active in commercial usage.; Consumers can access a test environment with APIs and test data free of charge.; Consumers access free of charge the Commissioners data via the Open API when approved by the Commissioner. The data access is protected by a key and IP address whitelisting and access is approved in a structured process involving the Commissioners. When approved the key exchange is done in a secure way.; No exclusivity exist with access to patient or clinical data when approved by the Commissioners. The platform does not have any data for anonymous access.; Access for an approved supplier will normally take less than a week and Controllers and Data subjects are not charged for their data.; Visiba does not charge for provisioning of interface services.
• API documentation: Yes
• API documentation formats:
  • Open API (also known as Swagger)
  • HTML
• API sandbox or test environment: Yes
• Customisation available: Yes
• Description of customisation: What can be customised:; ; Care pathway endpoints: Local configuration of triage destinations to reflect available services within each neighbourhood team; Appointment scheduling: Practice preference between patient-initiated self-scheduling or practice-initiated booking workflows; Clinic availability: Professional scheduling and appointment slot management; User access: Role-based permissions and access levels for different professional users; Reporting Parameters: Customisable data exports and analytics views through the statistics module; ; How users customise:; ; Administrator interface: Settings and configurations managed through the platform's administrative portal; Statistics module: Data filtering and export parameters configured by authorised users; Mobilisation phase: Major configuration decisions (care pathways, endpoints) established during implementation with Customer Success Manager support; ; Who can customise:; ; Practice administrators: Day-to-day configuration of scheduling, user access, and operational settings; Customer success manager: Supports initial setup and major configuration changes during implementation; Authorised clinical leads: Clinical workflow and care pathway decisions within their governance authority; ICB/System administrators: Higher-level organisational settings and reporting requirements where contracted

Scaling

• Independence of resources: Visiba Triage is hosted on Microsoft Azure's cloud infrastructure, providing enterprise-grade scalability and resource allocation. As a cloud-based solution, infrastructure automatically scales to meet demand without requiring local installation.; ; Proven scale:; Visiba serves over 7 million patients, demonstrating capacity to handle substantial concurrent demand across organisations.; ; Minimal impact operations:; System maintenance and updates are performed out of hours (1am-4am GMT) to prevent service disruption during peak usage periods.; ; Bandwidth requirements:; The solution requires minimal bandwidth per user (100 kbit/s without video, 500 kbit/s with video), ensuring stable performance even on 3G networks. This low requirement minimises competition for network resources.

Analytics

• Service usage metrics: Yes
• Metrics types: Operational performance:; - Patient engagement: triage completion rates, time-to-completion, pathway usage patterns, channel preferences; - Provider engagement: clinician interaction rates, decision support utilisation; ; Quality & experience:; - Patient feedback scores: satisfaction ratings, ease-of-use metrics, and qualitative feedback themes; - Provider feedback: clinical confidence scores, usability ratings; ; Clinical safety & AI performance; - Continuous AI accuracy monitoring; triage appropriateness, disposition accuracy, false positive/negative rates, incident reporting and resolution tracking; ; Localised intelligence; - Site-specific data tailored to each customer's patient demographics and case mix; - Comparative benchmarking against aggregated local data; - Seasonal and temporal trending specific to local demand patterns
• Reporting types:
  • API access
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: Yes
• FOCUS resource tagging: Yes

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Security Clearance (SC)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Encryption of all physical media
• Data sanitisation process: Yes
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001
• Data sanitisation type:
  • Deleted data can’t be directly accessed / Cryptographic Erasure
  • Data Erasure
  • Physical Destruction / Hardware containing data is completely destroyed

Data importing and exporting

• Data export approach: Customers have continuous access to a real-time dashboard providing immediate visibility into their service performance. ; ; For more detailed analysis or integration with local systems, customers can request raw data exports from Visiba.
• Data export formats:
  • CSV
  • ODF
• Data import formats: CSV

Data-in-transit protection

• Data protection between buyer and supplier networks:
  • Private network or public sector network
  • TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: Visiba operates a guaranteed availability policy with uptime commitment of 99.5%. This is calculated 24/7 on a monthly basis.; Service is "Unavailable" when no users can access and use the Service (excluding maintenance windows) and i measured by Provider's monitoring system.; ; Service Credits for SLA Breaches:; If monthly availability falls below the uptime threshold, customers are entitled to service credits as follows:; Monthly availability : 95.0% – 99.49%; Service credit : 10% of monthly fee; ; Monthly availability : 90.0% – 94.9%; Service credit : 25% of monthly fee; ; Monthly availability : 80.0% – 89.9%; Service credit : 50% of monthly fee; ; Monthly availability : Below 80%; Service credit : 100% of monthly fee; ; Maximum credits: Service credits in a single calendar month cannot exceed 100% of the monthly fee for that month.; ; How to claim service credits:; ; Customer must notify Visiba in writing within 30 calendar days of the end of the month for which a credit is requested. Credits are applied as deductions against the customer's next invoice. If there's insufficient amount to deduct (e.g., after contract termination), credits are paid directly to customer within 30 calendar days.
• Approach to resilience: Available on request.
• Outage reporting: Person of contact : The Customer Success Manager will establish a named person/s at the provider, who will be the first point of contact.; ; In-platform alerts: Users are notified via an alert when a system update has been carried out or an issue has occurred. ; ; Email alerts: Users who sign up receive pre-release emails with information about upcoming updates and release notes on the morning of releases, and updates on any outages.; ; ICB notifications: ICB digital teams can be added to the mailing list for software updates.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)
• Access restrictions in management interfaces and support channels: Access restrictions:; ; - Customers can create users of different tiers and access during onboarding (with Customer Success Manager support); - Categories of users can have tailored access to functionality such as, Statistics module for reporting and data exports, managing user access, configuring local pathways; - Training distinguishes between different user types (healthcare professionals, administrators, superusers); ; Support channel tiering:; ; Tier 1 (End Users/Patients): Customer is responsible for providing support to End Users (patients); Tier 2 (Professional Users): Can contact Visiba's Helpdesk for technical queries (phone, email, web chat during Service Hours); Tier 3 (Strategic/Process Questions): Handled by dedicated Customer Success Manager
• Access restriction testing frequency: At least every 6 months
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Public key authentication (including by TLS client certificate)

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: User-defined
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: User-defined
• How long system logs are stored for: User-defined

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: Visiba Triage is a CE-marked Medical Device and Visiba and our products (as relevant) conform to, or are certified as being compliant with:; ISO 27001, ISO 13485, ISO 14971; DCB0129; IEC 62366, IEC 62304, IEC 82304; GDPR ; Data Security and Protection Toolkit; Cyber Essentials Plus
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: All changes are reviewed under the Information Security Management System (ISO 27001) ISMS Scope standards, which covers security change procedures. This includes :; ; - Regular releases: Every three weeks with quality control; - Clinical Safety components: Versioned Clinical Safety Case Reports and Hazard Logs; - Vulnerability tracking: Resolved vulnerabilities documented in "latest version"; - Quality Management System (ISO 13485): Formal change control procedures documented (QMS2-QMS.20); - Annual accredited penetration testing on application security; Additional testing after major software iterations; - Zero-day vulnerability monitoring (e.g., LOG4J-2 assessment)
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: Assessing & identifying threats:; -Annual NCSC-accredited penetration testing on application security; - Additional penetration testing triggered after: Cyber incidents or major software iterations; - Browser/OS compatibility monitored - supports versions up to 12 months old; - Component Monitoring: Zero-day vulnerability tracking - Example: LOG4J-2 assessment performed and confirmed no impact; - Customer Support Manager is embedded into the service with regular scheduled touchpoints for identifying threats; ; Patch deployment:; - Three-week release cycles approximately; - All updates deployed out-of-hours (1am-4am GMT) to minimise disruption; - Automatic deployment - no user intervention required (cloud-hosted SaaS); - No downtime for users during updates
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: Identifying compromises: Protective monitoring controls detect compromise through weekly vulnerability scanning, annual penetration testing, threat intelligence (Microsoft Security Insider), security logging/audit trails, MDM-based antivirus/threat management, system monitoring (CPU/RAM/disk) and automatic capacity alerts. Access is monitored and logged; logs are retained for 5 years and reviewed yearly or upon suspicion of misuse.; ; Response: Issues are reported to Slack channel or Incident Team directly. The PRRC/DPO clarify incidents, assign priority levels and escalate accordingly. Root cause analysis is conducted for complex incidents.; ; Response speed: Critical incidents receive 30-minute response and 4-hour temporary resolution; Major incidents get 1-hour response and 8-hour resolution.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Incident management approach: Visiba has pre-defined processes for safety, security and service incidents, with priority levels (High/Medium/Low) based on clinical risk and GDPR impact. A standardised workflow covers detection through resolution, including investigation, corrective action and communication.; ; Reporting: Customers report via helpdesk/support@visibacare.com; internal staff use the #INCIDENTS Slack channel or contact the Incident Team directly.; ; Incident reports: Preliminary communications provide issue descriptions, impacts, workarounds and risk levels. Final communications detail corrective actions through standard release processes. All incidents are documented using standardised templates with naming conventions and maintained throughout the incident lifecycle.
• Post-quantum cryptography secure: Yes

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: Yes
• Connected networks: Health and Social Care Network (HSCN)

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 5%
• Between £500,001 and £1,000,000: 10%
• Between £1,000,001 and £2,500,000: 12.5%
• Between £2,500,001 and £5,000,000: 15%
• Over £5,000,001: 17.5%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: Yes
• Who accredited the ISO/IEC 27001: FINAS Finnish Accreditation Service
• ISO/IEC 27001 accreditation date: Friday 23 September 2022
• What the ISO/IEC 27001 doesn’t cover: N/A
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: No
• Cyber Essentials Alternative: None of the criteria
• Cyber essentials plus: Yes
• Please provide your Cyber Essentials Plus Certificate Number: Ee3ea750-9b3b-41c5-955e-61fa62038daf
• Other security certifications: No

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • New or retained jobs on the contract workforce in the relevant area that meet the criteria set out in MAC 1b, 1c and 1d
    • Providing opportunities for, and measuring and monitoring of, staff workforce conditions over time, including employee engagement, involvement in decision-making and satisfaction and adapting to any changes in the results, with clear processes for acting on issues identified
    • Monitoring of employee engagement rates (by protected characteristic) and, where necessary, the development of actions to ensure all voices are heard across the diversity of the workforce
    • Employment contracts that reflect actual hours worked; steps taken to ensure employees understand their contracts and have the ability to review and adjust them if actual hours regularly exceed contracted hours
    • Activities that support an environment where staff are educated about, and feel empowered to, address their physical wellbeing
    • Activities that support an environment where staff are educated about and feel empowered to report and address bullying and harassment
    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Monitoring and reporting of gender and ethnicity pay gaps and plans to address them where necessary
    • Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible
    • Understanding of in-work progression issues affecting the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
    • Measures to support in-work progression to help people in the contract workforce, to move into higher paid work by developing new skills relevant to the contract
    • Understanding of the modern slavery risks and issues affecting the market, industry, sector or country (of origin or of source) relevant to the contract, and the workforce in the supplier’s own organisation and those of its key subcontractors
    • Measures to identify, mitigate and manage modern slavery risks relating to the contract and how these will be implemented

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at contact@visibagroup.com. Tell them what format you need. It will help if you say what assistive technology you use.