BFB LABS LTD

Lumi Nova integrated with VitaMind Hub for child anxiety

Inclusive, immediate and cost-effective access to evidence-based mental health support for children and young people. Lumi Nova is a NICE-recommended digital therapeutic game for 7-12 year olds with anxiety difficulties. It is child-led, guardian-supported, Cognitive Behavioural Therapy-based, and provides meaningful data to commissioners and providers via the VitaMind Hub.

Features

• Instant on-demand access to NICE-recommended first line treatment option
• Story-based psychoeducation
• Goal options for most common childhood anxieties (eg.social, separation, phobias)
• Voice-guided exposure challenges, interactive multimedia exposure modules, gyroscopic environments
• In-app reward system for attempting and completing challenges
• Automated SMS update alerts to guardian and push notification reminders
• Limited gameplay time per session per day
• Real-time data reporting via secure platform (VitaMind Hub)
• Compatible with iOS, Android, Amazon Fire mobile / tablet devices
• Dedicated implementation and engagement support for local pathways & stakeholders

Benefits

• Cost-effective support for children in line with whole-family approaches
• Non-stigmatising and inclusive for children experiencing anxiety difficulties
• Neuro-affirming, trauma-informed - access for SEND & neurodivergent children
• Reduces waits for access to NICE-recommended support
• Enables self-management anytime anywhere via Cognitive Behavioural Therapy-based approach
• Engages children to set goals and create graded exposure ladders
• Enables users to complete imaginal and in-vivo exposures
• Access to real-time data for remote monitoring & reporting
• Provides rich data on access, engagement and validated outcome measures
• Can be used standalone for universal or population health approach

Service documents

• Pricing document

  ODT

• Service definition document

  ODT

• Terms and conditions

  ODT

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at kelly.tham@bfb-labs.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

935390024764196

Contact

Kelly Tham
07717750642
kelly.tham@bfb-labs.com

About your service

• Service categories:

  Applications

  Production and operations

  Service industry and public sector operations

  • Healthcare
  • Education
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model: Private cloud
• Service constraints: The VitaMind Hub will require maintenance windows for software updates, patches, and other maintenance activities that will be performed on a quarterly basis or as required in order to contribute to the functionality, stability and security of the service.; Any planned Maintenance and Software updates that will affect downtime will be communicated to end users via email.
• System requirements: Up-to-date web browser

User support

• Email or online ticketing support: Yes
• Support response times: Within 1-3 business days
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: No
• Support levels: We provide in and out of hours support with specific support processes in place for technical queries and implementation.; ; For technical queries: We provide support via email to all users.; ; For implementation support: We provide extensive mobilisation and implementation support to our customers with a dedicated Implementation team working with relevant stakeholders in a local area to help promote and embed the service in the area.; ; The cost of support is included within the contract value / price.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: For Users: Lumi Nova is designed to be intuitive and provides a guided tutorial within the app for Parents/Guardians and children. Prior to the app setup process, Parents/Guardians are provided with an online onboarding video, terms and conditions of use and privacy notice.; ; Implementation Service for Buyers: BFB Labs collaborates with key stakeholders across relevant places/localities to identify appropriate points of dissemination, and works with relevant operational and clinical leads to help embed provision of Lumi Nova into care pathways and standard operating procedures to ensure families are able to access it quickly and effectively.; ; This includes facilitating a service pathway mapping workshop with key pathway leads to:; ; - Understand the user journeys / existing pathways; - Agree how Lumi Nova will be implemented within the various pathways; - Identify key touch points with families; - Identify support / resources that are needed to maximise usage; ; Training: Virtual Discovery Sessions for professionals signposting; Virtual or face-to-face Training for professionals using the Hub; ; We also work with relevant communication and engagement leads to identify avenues to cascade information and promote access to Lumi Nova, especially where self sign-up to Lumi Nova is available for families.
• Service documentation: Yes
• Documentation formats:
  • HTML
  • PDF
  • Other
• Other documentation formats: Online training videos
• End-of-contract data extraction: Exit planning is discussed at the start of the service so that we can establish expectations and agree processes. Data can be exported in a standard csv format via the VitaMind Hub eliminating the need to transfer data outside of the secure system. Alternative formats and processes may be available and can be discussed during contract negotiations.
• End-of-contract process: Exit planning is discussed at the start of the service so that we can establish expectations and agree processes. Processes will ensure a safe exit for users and clear information provided as to where else they might be able to receive support. Cut off dates for when new users cannot sign-up, be signed-up to, or use Lumi Nova is communicated. Following the agreed expiry date, we agree with services (the buyer / data controller) what they would like to do with the data. They have the option receive it, after which the data on our servers is anonymised.
• Documentation accessibility standard: None or don’t know
• How the documentation is accessible: Communications and documentation are in written in plain English. Marketing and promotion assets similarly have clear wording using everyday language, contrast colours with alt text provided. Digital and physical documentation is provided to improve accessibility. Website content can be translated into a selection of common languages.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari
• Application to install: Yes
• Compatible operating systems:
  • Android
  • IOS
  • Other
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: Lumi Nova is a native mobile app for children and young people designed to be used on smartphone and tablet devices.; ; VitaMind Hub for professionals is a secure online dashboard/portal designed to be used on laptops or desktop computers via a web browser.
• Service interface: Yes
• User support accessibility: None or don’t know
• Description of service interface: The VitaMind Hub is a cloud based online platform accessible via a web browser for professionals to manage access to Lumi Nova app and view engagement, progress and outcomes data.; It also enables families to self sign-up for access where deployed as a universal offer.
• Accessibility standards: None or don’t know
• Description of accessibility: Lumi Nova app for children: includes accessibility settings to enable children to customise their experience (eg. text/reading speed, voiceovers, sound controls). Goal selection and associated challenges can also be customised by users, and children can customise their characters to reflect their chosen identity.
• Accessibility testing: We've not done any testing with users of assistive technology, however we have done extensive testing with a range of users, including those who are neurodivergent and made our service more accessible, eg. including voiceovers.
• API: No
• Customisation available: Yes
• Description of customisation: Lumi Nova app for children: goal selection and associated challenges can be customised by users, in addition to optional accessibility settings. Children can also customise their characters.; ; VitaMind Hub for professionals: certain fields, support information, and area restrictions can be customised to capture data of importance to the buyer.; Access and service implementation model can be customised depending on key objectives of the Buyer.

Scaling

• Independence of resources: We use AWS to manage server usage which automatically adjusts to the needs of the software.

Analytics

• Service usage metrics: Yes
• Metrics types: Key markers of success are collaboratively discussed from the start as part of contract negotiations so that we can establish expectations and work together to ensure success.; ; The VitaMind hub provides real-time engagement, progress and outcome measures data on users for authorised professionals using Lumi Nova alongside pathways, and for those wanting oversight.; ; We also provide regular anonymised and aggregated reports to the Buyer and key stakeholders, covering the key areas in relation to access, outcomes and if possible, experience (where families opt to provide feedback, as we're a software provider and do not interact face-to-face with end users regularly).
• Reporting types:
  • Real-time dashboards
  • Regular reports
  • Reports on request
• Resource tagging: No
• FOCUS resource tagging: No

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: None

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Managed by a third party
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest: Encryption of all physical media
• Data sanitisation process: Yes
• Equipment disposal approach: A third-party destruction service
• Data sanitisation type: Deleted data can’t be directly accessed / Cryptographic Erasure

Data importing and exporting

• Data export approach: VitaMind Hub: A data download is automatically made available to authorised users on the 1st of every month that can be downloaded.; Lumi Nova app: Parents/guardians/users are asked to accept privacy policy and user terms and conditions prior to signing up to Lumi Nova. This privacy policy explains how they can ask to access their data (data subject request) by contacting the Data Protection Officer at BFB Labs.
• Data export formats: CSV
• Data import formats: Other
• Other data import formats: Not applicable - no capability to import data

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: We use reasonable endeavours to ensure that the uptime for the VitaMind Hub is at least 99.9% during each calendar month.; ; We may from time to time suspend access to the VitaMind Hub for the purposes of scheduled maintenance and use best endeavours to ensure that all scheduled maintenance is carried out outside Business Hours or during low usage times and give the customer prior written notice of scheduled maintenance that will, or is likely to, affect availability.; ; If we fail to meet the guaranteed level of availability, we provide compensation in the form of an extension of the service at no additional cost to the Customer ("Service Credit").
• Approach to resilience: Available on request
• Outage reporting: Outages will be reported via email alerts.

Identity and authentication

• User authentication needed: Yes
• User authentication: Username or password
• Access restrictions in management interfaces and support channels: The VitaMind Hub supports role based access for Buyer's authorised staff to restrict access to high level data/reports and personal identifiable information.; ; Within BFB Labs organisation, access controls are allocated on the basis of business need and ‘Least Privilege’. Users are provided with the absolute minimum access rights, permissions to systems, services, information and resources that they need to fulfil their business role.
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Username or password

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: At least 12 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: Yes
• Security governance standards: Other
• Other security governance standards: NHS Digital Technologies Assessment Criteria (DTAC) - NHSE approved; NHS Data Security and Protection (DSP) Toolkit; ICO Registration; CE Mark registered medical device with UK Medicines & Healthcare Products Regulatory Agency (MHRA)
• Information security policies and processes: ACCREDITATIONS:; DTAC approved by NHSE; DSP Toolkit published on NHSE portal; CyberEssentials Certified; ICO registered; ; ADHERANCE TO:; UK's GDPR; DCB0129 Directive; ; POLICIES:; BFB Labs Remote Access Policy; BFB Working From Home IT Security Policy; Data Protection and Confidentiality Policy BFB Labs; Information Governance Policy; Password Policy BFB Labs; Record Retention & Disposal Policy BFB Labs.; ; All policies are reviewed by our DPO and approved by our SIRO who is also our CEO, ensuring a culture that upholds the key principles of information security. Processes for all governance and security aspects, including staff training, data protection and retention, access permissions, risk and incident management, amongst others, are captured within our policies and maintained in our Quality Management System which is overseen by our Compliance Lead.
• Software Security Code of Practice: Yes

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: We assess changes for software & clinical risks, aligning with ISO27001 & our SOPs. All software releases require clinical safety authorisation, considering beta tester feedback. Our unified change management oversees certified medical devices, including SaMD in NHS settings. Four categories guide changes: Minor, Major, Design Change, & Change to Intended Use or New Product. Minor changes are low-risk adjustments but require clinical authority to release (CATR). Major changes pose medium risk, potentially needing new risk reports. Design changes are high risk, needing full clinical safety assessments. Changes to intended use or new products often require re-certification.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: We contract a CREST-approved service provider who runs annual penetration testing on our system.; ; Vulnerabilities are assessed against OWASP, RAG rated and addressed in line with our risk management standard operating procedures with patches released based on severity and risk.
• Protective monitoring type: Supplier-defined controls
• Protective monitoring approach: Our hosting provider, AWS' CloudTrail service provides protective monitoring which enables governance, compliance, operational auditing by alerting BFB Labs of potential compromises.; ; Incidents are addressed in line with our risk management standard operating procedures with patches released based on severity and risk.
• Incident management type: Supplier-defined controls
• Incident management approach: BFB Labs have a pre-defined Incident Management procedure that is triggered in the event of identification of an Incident which has been detected by or reported to BFB Labs through email, telephone or other direct communications.; ; There are 8 stages in the BFB Labs Incident Management procedure:; Logging and Triage; Engagement; Risk Assessment; Replication; Root Cause Analysis; Risk Management / Nonconforming Product Control; Delivery; Closure; ; Each stage involves specific actions and documentation, ensuring comprehensive incident management and resolution.; ; We would provide incident reports via email communication.
• Post-quantum cryptography secure: No

Secure development

• Approach to secure software development best practice: Conforms to a recognised standard, but self-assessed

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: No

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 6%
• Between £500,001 and £1,000,000: 9%
• Between £1,000,001 and £2,500,000: 12%
• Between £2,500,001 and £5,000,000: 15%
• Over £5,000,001: 18%

Non-mandatory Standards and certifications

• ISO/IEC 27001 certification: No
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: Yes
• Please provide your Cyber Essentials Certificate Number: Ec5be105-d93c-46b5-a375-a293a033d1cc
• Cyber essentials plus: No
• Cyber Essentials Alternative: None of the criteria
• Other security certifications: Yes
• Any other security certifications: NHS Data Security and Protection Toolkit - Meets Standards

Social value

• Section B - Commitment for Future: Delivery:

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

    • Payment of more than the National Minimum Wage or National Living Wage (as appropriate) to the contract workforce
    • Entitlement to sick pay for the contract workforce, with provision in place for any staff who do not meet the earnings threshold for statutory sick pay, payment of sick pay from day one of absence and payment of staff on the contract workforce who are off sick a replacement income of 100% of their usual earnings for as long as possible

  • Mission: Kick start economic growth. To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

    Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

    • Understanding of local demographics, needs and opportunities for the co-design of the goods, services and works to be delivered under the contract
    • Measures to engage users and communities and build relationships to increase community integration build trust and influence how the contract is delivered

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 6: Employment and training: For those who face barriers to employment

    • Understanding of the issues affecting the representation of disabled people in the workforce in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors
    • Inclusive and accessible recruitment practices, and retention-focused activities, including those provided in the Guide for line managers on recruiting, managing and developing people with a disability or health condition
    • Working conditions which promote an inclusive working environment and promote retention and progression
    • Understanding of the issues affecting inequality in employment, skills and pay in the market, industry or sector relevant to the contract, and in the supplier’s own organisation and those of its key sub-contractors. Measures to tackle inequality in employment, skills and pay in the contract workforce

  • Mission: Break down barriers to opportunity: By reforming our childcare and education systems, to make sure there is no class ceiling on the ambitions of young people in Britain

    Policy Outcome 7: Creating a pipeline of opportunities: For the contract workforce, reducing barriers to entry for under-represented groups.

    • Understanding of the issues affecting the development of new skills by target cohort

Service documents

• Pricing document

  ODT

• Service definition document

  ODT

• Terms and conditions

  ODT

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at kelly.tham@bfb-labs.com. Tell them what format you need. It will help if you say what assistive technology you use.