TINY MEDICAL APPS LTD

Digital Health Passport

The Digital Health Passport is a clinically assured SaaS platform supporting self-management, prevention and continuity of care for children and young people with long-term conditions. Used across NHS ICBs and Local Authorities, it aligns with NICE guidance, Core20PLUS5 priorities and NHS Login, without replacing existing systems or increasing workforce burden.

Features

• Young-person-centred mobile app for health self-management and wellbeing
• NHS Login integration for secure access to NHS digital services
• Personalised digital care and emergency plans, clinician approved
• Structured self-management journeys for long-term conditions
• Clinically validated health, wellbeing and symptom tracking
• Real-time air quality, pollen and weather risk alerts
• Configurable CMS for localised, trusted content management
• Local “My Area” pages for services, contacts and pathways
• Analytics dashboard showing anonymised uptake and engagement
• Modular, scalable SaaS with no local infrastructure required

Benefits

• Reduces avoidable urgent and emergency care demand
• Supports Core20PLUS5 priorities through targeted digital outreach
• Improves continuity and safety during transition to adult services
• Provides population-level insight for assurance and commissioning
• Reduces statutory risk across SEND and vulnerable cohorts
• Strengthens early intervention without increasing workforce capacity
• Improves attendance, engagement and learner stability
• Supports safer transitions across education, care and health
• Enables joined-up delivery across health, education and social care
• Scalable, clinically assured prevention with predictable, cost-effective delivery

• Free trial available

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at hello@tinymedicalapps.com. Tell them what format you need. It will help if you say what assistive technology you use.

Framework

G-Cloud 15

Service ID

940919682768249

Contact

Matt Bourne
02078594169
hello@tinymedicalapps.com

About the service

• Service categories:
  • Applications
    • Production and operations
      • Service industry and public sector operations
        • Healthcare
        • Education
        • Children's Social Care
• Multi cloud support: No

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: No
• System requirements:
  • Access to a mobile app
  • Internet access

User support

• Email or online ticketing support: Yes
• Support response times: User support is available by email and ticketed web chat support between 9am - 5pm (UK time) Monday to Friday. Incoming messages from users are responded to within one (1) business day.
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: Yes
• Web chat support availability: 9 to 5 (UK time), Monday to Friday
• AI chatbot: No
• Web chat support accessibility standard: WCAG 2.2 AAA
• Web chat accessibility testing: https://www.intercom.com/blog/messenger-accessibility/
• Onsite support: No
• Support levels: The Digital Health Passport platform is deployed as a patient-facing mobile app download. As such no technical support is required by NHS commissioners. We do provide account managers and dedicated customer support.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Standard onboarding is provided through documentation, recorded guidance and configuration support. Optional implementation, clinical safety workshops and tailored training can be purchased separately under G-Cloud Lot 3
• Service documentation: Yes
• Documentation formats: PDF
• Documentation accessibility standard: WCAG 2.2 AA
• End-of-contract data extraction: Once the contract has ended unsupported app users will be logged out of NHS login and will be able to login using social login. Their data will still be accessible and users will no longer have access to NHS supported features within the app. Users can request their using support contacts at any time.
• End-of-contract process: On receipt of termination request we will notify the project sponsor, clinical sponsor and clinical champion by email of the service end date and confirming that access and support will be withdrawn.; Users of the app will be notified in app that the NHS supported features are to be terminated and can request to extract their data in line with GDPR in a portable format.

Using the service

• Web browser interface: No
• Application to install: Yes
• Compatible operating systems:
  • Android
  • IOS
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: The Digital Health Passport is a native mobile app only available on mobile devices (Android and iOS)
• Service interface: No
• User support accessibility: WCAG 2.2 AA
• API: No
• Customisation available: No

Scaling

• Independence of resources: Automatic Scaling: Cloud Run's dynamic scaling capability adjusts resource allocation in real time based on incoming traffic. This feature efficiently manages demand spikes and minimizes resources during lower traffic periods, optimizing performance and cost-effectiveness without sacrificing service quality.

Analytics

• Service usage metrics: Yes
• Metrics types: We provide a delivery portal for customers where they can see near real-time data from users, including aggregated user activity broken down each month. Reports can be exported in MS Word and PDF formats.
• Reporting types: Real-time dashboards
• Resource tagging: No
• FOCUS resource tagging: No

Supplier type

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Other security clearance
• Government security clearance: Baseline Personnel Security Standard (BPSS)

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 4.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a CREST-approved service provider
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v4.0
  • Physical access control, complying with SSAE-18 / ISAE 3402
  • Physical access control, complying with another standard
  • Encryption of all physical media
• Data sanitisation process: Yes
• Data sanitisation type: Explicit overwriting of storage before reallocation / Secure Erase
• Equipment disposal approach: Complying with a recognised standard, for example CSA CCM v4.0, CAS (Sanitisation) or ISO/IEC 27001

Data importing and exporting

• Data export approach: End users (patients) retain control over their personal data. Tiny Medical Apps acts as a data processor for the delivery of the service, with data controller responsibilities varying by function and commissioning context. For example, NHS England acts as Data Controller for medicines-related services enabled through NHS Login.; ; Commissioners are provided with anonymised and aggregated service-usage data for assurance, evaluation and reporting purposes.; ; Users can export a copy of their personal data at any time via an in-app request. This is an automated process that provides a time-limited, secure link to a password-protected folder containing the user’s data.
• Data export formats:
  • CSV
  • Other
• Other data export formats:
  • PDF
  • Image
• Data import formats: Other
• Other data import formats:
  • PDF
  • Image

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: A Financial Credit is available where in a given calendar month service availability falls between; 1. 99% and 99.99% - at 10% of monthly service costs.; 2. Below 99% - at 25% of monthly service costs.
• Approach to resilience: The resilience of the Digital Health Passport is underpinned by it's deployment on Cloud Run, a core component of Google Cloud Platform.; ; This leverages several features designed to ensure robust resilience:; ; Fully Managed Infrastructure: Cloud Run provides a managed environment where Google handles all infrastructure maintenance, including servers and networking equipment. Regular updates and patches are applied swiftly to mitigate vulnerabilities, ensuring consistent service availability.; ; Automatic Scaling: Cloud Run's dynamic scaling capability adjusts resource allocation in real time based on incoming traffic. This feature efficiently manages demand spikes and minimizes resources during lower traffic periods, optimizing performance and cost-effectiveness without sacrificing service quality.; ; Containerization: Using Docker container technology, Cloud Run ensures the Digital Health Passport operates in a controlled setting. This approach encapsulates the application and its dependencies, minimizing potential discrepancies and conflicts from diverse operational environments.; ; Monitoring and Alerts: Comprehensive monitoring tools on Cloud Run track resource usage and system health. Real-time insights and automated alerts identify and address issues promptly, ensuring continuous service availability and reliability.; ; These features collectively enhance the resilience of the Digital Health Passport, maintaining its reliability, security, and continuous availability.
• Outage reporting: The Digital Heath Passport service is closely monitored in several ways.; ; Betterstack provides sophisticated API monitoring linked to email, slack and phone.; ; GCP Cloud Monitoring has alerts when resource usage passes defined thresholds.

Identity and authentication

• User authentication needed: Yes
• User authentication: Multi-Factor Authentication (MFA)
• Access restrictions in management interfaces and support channels: Access Control is covered by an ISO 27001 certified SOP. It relies on technical controls such as RBAC and MFA
• Access restriction testing frequency: At least once a year
• Management access authentication:
  • Multi-Factor Authentication (MFA)
  • Identity federation with existing provider (for example Google Apps)
  • Username or password

Audit information for users

• Access to user activity audit information: No audit information available
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: At least 12 months
• How long system logs are stored for: At least 12 months

Security governance

• Named board-level person responsible for service security: Yes
• Software Security Code of Practice: Yes
• Security governance certified: Yes
• Security governance standards: ISO/IEC 27001
• Information security policies and processes: TMA are an ISO 27001 certified organisation. The Digital Health Platform is within scope.; A summary information security policy is available in an easy read form.; Detailed security policies cover all the clauses and controls of ISO 27001, such as:; Human Resource Security, Access Control, Incident Management and Business Continuity. Operational and Communication Security, Supplier Relationships and System Acquisition and Development.; Internal Audits report to management meetings with external audits annually from UKAS certified auditors.

Operational security

• Configuration and change management standard: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Configuration and change management approach: TMA Quality Management System is compliant to ISO 13485 (quality management systems of medical devices), ISO 14971 (risk management of medical devices) and DCB0129 (clinical safety risk management of health IT).; ; All 3 standards have an element of change control as part of the quality and risk management process. The procedure in the TMA QMS which governs change control is TMA-SOP-D009 (Control of Software Design Changes). Change control is a Gateway 1 activity in the TMA software development lifecycle, where proposed changes are assessed for impact to regulations and safety/security risk to determine the validation required prior to release.
• Vulnerability management type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Vulnerability management approach: Vulnerabilities are managed in multiple ways.; ; A weekly vulnerability test (on staging) is performed as part of TMA's automated vulnerability scanning (Beagle Security).; ; Github has dependabots alerting enabled to notify TMA of vulnerabilities in any dependency.; ; We subscribe to National Cyber Security Centre's Threat Reports and Advisories as well as other security industry newsletters.; ; TMA has the capability to deploy urgent patches within 1 business day.
• Protective monitoring type: Complies with a recognised standard, for example CSA CCM v4.0 or SSAE-18 / ISAE 3402
• Protective monitoring approach: High level protective monitoring is built in at a high level to the Google Cloud Platform.; ; Additionally this is covered by a number of IS27001 SOPs.; Operational Security, Information Security Incident Management and Compliance.; ; TMA’s response and fix times are in line with those established in the HSCN Consumer Handbook (Service levels and incident severity classification).; ; There are two levels of severity.; ; Severity 1 - Critical Impact.; 3 hours response, 24 hours fix.; ; Severity 2 - Adverse impact.; 3 hours response, 48 hours fix.; ; These are in line with the non-business critical nature of our service.
• Incident management type: Complies with a recognised standard, for example, CSA CCM v4.0 or ISO/IEC 27035:2011 or SSAE-18 / ISAE 3402
• Post-quantum cryptography secure: Yes
• Incident management approach: The Tiny Medical Apps Incident Management (Security and Critical) procedure is triggered in the event of identification of an incident which has been detected by or reported to Tiny Medical Apps through any route.; ; There are 8 stages in the Tiny Medical Apps Incident Management procedure:; ; 1. Logging and Triage; 2. Engagement; 3. Risk Assessment; 4. Replication; 5. Root Cause Analysis; 6. Risk Management / Nonconforming Product Control; 7. Delivery; 8. Closure

Secure development

• Approach to secure software development best practice: Independent review of processes (for example CESG CPA Build Standard, ISO/IEC 27034, ISO/IEC 27001 or CSA CCM v4.0)

Public sector networks

• Connection to public sector networks: No

Pricing

• Discount for educational organisations: No
• Free trial available: Yes
• Description of free trial: The Digital Health Passport is freely available to download and use from app stores. This version does not include NHS login, medicines support or localised information or content. There is no access to analytics dashboards.
• Link to free trial: https://getdhp.link

Discount percentage by annual call-off contract value (excluding VAT)

• Less than £250,000: 0%
• Between £250,000 and £500,000: 5%
• Between £500,001 and £1,000,000: 10%
• Between £1,000,001 and £2,500,000: 15%
• Between £2,500,001 and £5,000,000: 25%
• Over £5,000,001: 35%

Standards and certifications

• ISO/IEC 27001 certification: Yes
• ISO/IEC 27001 accredited by: Alcumus Isoqar (UKAS)
• ISO/IEC 27001 accreditation date: Thursday 20 March 2025
• What the ISO/IEC 27001 doesn’t cover: TMA's scope is deliberately broad to cover the organisation and its platforms. See below.; ; Information Security as applied to Tiny Medical Apps and the management and delivery of our software platforms and supporting infrastructure, in line with the Statement of Applicability version 3.0 dated 184Mar 2025
• ISO 28000:2022 certification: No
• ISO 9001 certification: No
• Quality management systems (QMS): Yes
• CSA STAR certification: No
• PCI certification: No
• Cyber essentials: No
• Cyber Essentials Alternative: In relation to the services you do not have a current and valid Cyber Essentials certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials certificate by one of the government approved accreditation bodies within 12 months of the date of award.
• Cyber essentials plus: No
• Cyber Essentials Alternative: In relation to the services you do not have a current and valid Cyber Essentials Plus certificate which has been awarded by one of the government approved Cyber Essentials accreditation bodies but you are working towards gaining it, and will be in a position to confirm that you have been awarded a current and valid Cyber Essentials Plus certificate by one of the government approved accreditation bodies within 12 months of the date of award.
• Other security certifications: No

Social value

• Mission: Kick start economic growth:

  To secure the highest sustained growth in the G7 - with good jobs and productivity growth in every part of the country making everyone, not just a few, better off.

  Policy Outcome 1: Fair work: That offers fair wages and good working conditions. Help people get a job, stay in work, and progress in their careers, with good employment opportunities across the country. Notes: Where there is a large proportion of labour costs in the contract, commercial teams should consider MAC in Outcome 1 as a priority

  • Activities to cascade good practice on fair working conditions throughout the supply chain

  Policy Outcome 3: Resilient, innovative and flexible supply chains: Support economic growth through enabling resilient businesses, opportunities for small businesses and voluntary, community and social enterprises

  • Activities to identify opportunities to open up sub-contracts under the prime contract to a diverse range of businesses, including new businesses, entrepreneurs, start-ups, SMEs, VCSEs and mutuals
  • Activities that demonstrate a collaborative way to work with a diverse range of businesses as part of the supply chain
• Mission: Build an NHS fit for the future:

  That is there when people need it; with fewer lives lost to the biggest killers; in a fairer Britain, where everyone lives well for longer.

  Policy Outcome 8: Increasing productivity through physical and mental wellbeing: In the supply chain and communities in the relevant area.

  • Understanding of issues relating to health and wellbeing, including physical and mental health, in the contract workforce

Service documents

• Pricing document

  PDF

• Service definition document

  PDF

• Terms and conditions

  PDF

Request an accessible format

If you use assistive technology (such as a screen reader) and need versions of these documents in a more accessible format, email the supplier at hello@tinymedicalapps.com. Tell them what format you need. It will help if you say what assistive technology you use.