XPLORO LIMITED

Xploro

Xploro® is a clinically proven Digital Therapeutics platform that uses augmented reality, gameplay and artificial intelligence to deliver health information to young patients, reducing the anxiety associated with hospitalisation, improving health literacy and fostering better engagement with health services.
The platform comprises: Patient App, Parent App and Management Portal.

Features

• 3D augmented reality environments (ward, operating theatre, anaesthesia room etc)
• 3D augmented reality treatments (MRI, CTScan, Patient Monitor etc)
• Multiplayer games (each with a clinical learning outcome)
• Patent-pending chatbot answers medical and general questions
• Child-friendly appointments calendar
• Mood diary
• Patient Reported Outcomes module
• Parent app (integrates with child's in-app calendar)
• Management portal (integrates with child's in-app calendar)
• Works in both online and offline environments

Benefits

• Reduces anxiety
• Reduces repeat procedures
• Encourages adherence
• Encourages patient feedback (PROMs and PREMs)
• Improves health literacy

£7,200.00 a licence a year

• Free trial available

Service documents

• Pricing document (pdf)
• Service definition document (pdf)
• Terms and conditions (pdf)

Framework

G-Cloud 12

Service ID

915840770956555

Contact

Dom Raban
01618380808
dom@xploro.health

Service scope

• Software add-on or extension: No
• Cloud deployment model: Public cloud
• Service constraints: The Xploro patient app is available for Android and iOS tablets and mobiles (minimum specification applies). It cannot be used on desktop or laptop computers.
• System requirements:
  • Patient app: iOS 13+ (Apple) or Android 8+ (Android)
  • Parent app and Management portal: see supported browsers below

User support

• Email or online ticketing support: Email or online ticketing
• Support response times: We will respond within eight working hours ; (Mon - Fri not including Bank Holidays)
• User can manage status and priority of support tickets: No
• Phone support: Yes
• Phone support availability: 9 to 5 (UK time), Monday to Friday
• Web chat support: No
• Onsite support: Yes, at extra cost
• Support levels: We offer technical support for your organisation, either by phone or email, when implementing Xploro and onboarding, as well as once everything is up and running.; ; This support will be available during office hours and we aim to respond, in the first instance, within eight working hours of hearing from you. At that stage if we are unable to offer a fix we will let you know when you can expect it.; ; There is no additional cost for this support.; ; Support for end users is via the Parent Portal.
• Support available to third parties: Yes

Onboarding and offboarding

• Getting started: Getting started is simple and straightforward:; ; As an Admin user you will receive an email with a link to the Admin Portal and your own unique password.; ; When you follow the link you will be prompted to enter your email address and unique password.; ; You will then be prompted to change your password and log in to the Admin Portal with your new credentials.; ; Once logged in successfully you will be presented with the Admin Portal dashboard. From here you can add more Admin users, begin adding and managing App users, access App users’ calendars, and update information on hospital WiFi codes for App users.; ; We will offer an online demonstration, written instructions, and phone support however the admin portal has been designed to be intuitive and easy to use.
• Service documentation: Yes
• Documentation formats: HTML
• End-of-contract data extraction: Data that is owned by the customer can be extracted into a file format as agreed with Xploro according to GDPR compliant processes.
• End-of-contract process: Contracts for the Xploro platform are offered on an annual basis. At the end of the contract the license can be renewed for a further year or terminated.

Using the service

• Web browser interface: Yes
• Supported browsers:
  • Internet Explorer 9
  • Internet Explorer 10
  • Internet Explorer 11
  • Microsoft Edge
  • Firefox
  • Chrome
  • Safari 9+
• Application to install: Yes
• Compatible operating systems:
  • Android
  • IOS
• Designed for use on mobile devices: Yes
• Differences between the mobile and desktop service: The Xploro patient app is only available on iOS and Android tablet and mobile devices - iOS or Android.; ; The Xploro Parent App and Management Portal are responsive web applications with no differences in functionality between desktop and mobile versions.
• Service interface: No
• API: No
• Customisation available: Yes
• Description of customisation: Both the admin portal and the parent portal can be customised to include your organisation's logo and branding.; ; The Management Portal allows admins to customise various features and settings within the Patient App including:; • Hospital staff roles and uniforms; • AI chatbot knowledgebase (wifi codes, meal and visiting times etc); ; Organisations can commission additions to the Xploro Patient App including:; • branded splash screen; • unique app store download; • custom environments; • custom knowledge base for AI; • custom games; • custom treatments.; ; For example The Christie NHS Foundation Trust commissioned a Proton Beam Therapy treatment module with complimentary chatbot responses, and 3D models of their reception areas.; ; There is an additional cost for bolt-on modules and customisation.

Scaling

• Independence of resources: We utilise AWS infrastructure so that we can quickly and easily scale to meet the demands of our users. We monitor server load via our status servers and can make on demand changes.; ; The Xploro API is a monolithic application and we are currently in the process of developing smaller services so that we can scale individual parts of the application to meet need as well.

Analytics

• Service usage metrics: Yes
• Metrics types: Usage; • Number of subscriptions available / used; • Number of users active; • Most popular areas; • retention; • Age; • 'last seen online' by user; • Uninstalls; • Devices; Mood (anonymised); • most common mood per event type; • most common mood per date range; • number of moods recorded daily, over time; Chatbot; • number of questions asked; • number of exact responses; • number of close matches; • number of 'no idea' responses; Calendar; • number of patient / parent / clinician events; • number of events with moods attached; • number of events by category
• Reporting types: Real-time dashboards

Resellers

• Supplier type: Not a reseller

Staff security

• Staff security clearance: Staff screening not performed
• Government security clearance: None

Asset protection

• Knowledge of data storage and processing locations: Yes
• Data storage and processing locations: United Kingdom
• User control over data storage and processing locations: No
• Datacentre security standards: Complies with a recognised standard (for example CSA CCM version 3.0)
• Penetration testing frequency: At least once a year
• Penetration testing approach: ‘IT Health Check’ performed by a Tigerscheme qualified provider or a CREST-approved service provider
• Protecting data at rest:
  • Physical access control, complying with CSA CCM v3.0
  • Physical access control, complying with SSAE-16 / ISAE 3402
  • Encryption of all physical media
• Data sanitisation process: Yes
• Data sanitisation type: Deleted data can’t be directly accessed
• Equipment disposal approach: A third-party destruction service

Data importing and exporting

• Data export approach: Users must make a written request to Xploro and we will send them any personal data based on that request.
• Data export formats: CSV
• Data import formats: Other
• Other data import formats: Data import not supported

Data-in-transit protection

• Data protection between buyer and supplier networks: TLS (version 1.2 or above)
• Data protection within supplier network: TLS (version 1.2 or above)

Availability and resilience

• Guaranteed availability: Xploro® provides 99.5%+ availability. Service credits for any downtime are available and are calculated as a percentage of the monthly billing due in the moth that is affected:; Less than 99.5% but equal to or greater than 99%: 10%; Less than 99% but equal to or greater than 95%: 30%; Less than 95%: 100%
• Approach to resilience: Information is available on request.
• Outage reporting: The system has no automatic warnings. When an incident is detected customers are notified via email. An incident report is produced and can be made available on request.

Identity and authentication

• User authentication needed: Yes
• User authentication:
  • 2-factor authentication
  • Username or password
• Access restrictions in management interfaces and support channels: In the API access is restricted to different user types, each user type has scope permissions in what they can access. ; All access points have enforced authentication. Direct access to support the databases and infrastructure is limited to a very small team who have been issued a named account and connect in directly to the data centers using two-factor authentication.; All access to the codebase and deployment tools have enforced 2 factor authentication.
• Access restriction testing frequency: At least once a year
• Management access authentication: Other
• Description of management access authentication: We have internal an OAuth2 authentication server which deals with user authentication. Before a user can access Xploro® they have to be manually approved by another admin or superadmin.

Audit information for users

• Access to user activity audit information: Users contact the support team to get audit information
• How long user audit data is stored for: Between 1 month and 6 months
• Access to supplier activity audit information: Users contact the support team to get audit information
• How long supplier audit data is stored for: Between 1 month and 6 months
• How long system logs are stored for: Between 1 month and 6 months

Standards and certifications

• ISO/IEC 27001 certification: No
• ISO 28000:2007 certification: No
• CSA STAR certification: No
• PCI certification: No
• Other security certifications: Yes
• Any other security certifications: Cyber Essentials

Security governance

• Named board-level person responsible for service security: Yes
• Security governance certified: No
• Security governance approach: We work to ISO 27001 standards.
• Information security policies and processes: At Xploro we have processes in place that enable our team to have rapid access to change and manage the system where necessary.; We have integrated CI processes within our gitlab repository where code is reviewed and deployed to our AWS infrastructure.; Internal cloud monitoring servers inform us quickly of any issues in a production environment.

Operational security

• Configuration and change management standard: Supplier-defined controls
• Configuration and change management approach: At Xploro® we have processes in place that enable our team to have rapid access to change and manage the system where necessary. We have integrated CI processes within our gitlab repository where code is reviewed and deployed to our AWS infrastructure and internal cloud monitoring servers which inform us quickly of any issues in a production environment.
• Vulnerability management type: Supplier-defined controls
• Vulnerability management approach: At Xploro® we constantly monitor news feeds for any emergency vulnerability updates and patches that need to be updated so that we can respond quickly to immediate threats. ; We also have a regular scheduled update and patch period where we perform updates of the software we use across different platforms to ensure we are up to date.
• Protective monitoring type: Conforms to a recognised standard, for example CSA CCM v3.0 or SSAE-16 / ISAE 3402
• Protective monitoring approach: At Xploro® we constantly check that our systems are up to date and have processes in place to check for and identify any compromising issues. Our response depends on the type of compromise and its severity. We have various incident/security event detection processes to ensure our response is timely, controlled and consistent.
• Incident management type: Supplier-defined controls
• Incident management approach: Xploro has defined documentation which we produce should an incident occur with the system. We outline exactly what cause the problem and the immediate steps we have taken to remedy it. If any data is compromised we inform the ICO of the data that was compromised.

Secure development

• Approach to secure software development best practice: Supplier-defined process

Public sector networks

• Connection to public sector networks: No

Pricing

• Price: £7,200.00 a licence a year
• Discount for educational organisations: No
• Free trial available: Yes
• Description of free trial: Free Trials are only available to new subscribers to the Xploro Services and are available at Xploro’s sole discretion from time to time. Previous Subscription holders or those who have previously received a trial of the Xploro Services do not qualify for a Free Trial.

Service documents

• Pricing document (pdf)
• Service definition document (pdf)
• Terms and conditions (pdf)