Qwell.io Service Definition - G-Cloud 14

About Us

Since 2001 Kooth Digital Health has been the UK’s leading provider in digital mental health care and support, providing innovative, digital, research-based, person-centred mental health support to the UK population in partnership with the NHS, Local Authorities, and other Health and Social Care providers. Kooth Digital Health is the longest standing accredited digital health provider by the BACP. We are the largest provider to the NHS for digital mental health services and the largest contributor to the MHSDS. Over 1m people have used a Kooth Digital Health platform across our history. Over 1m counselling hours have been delivered over the platforms.

Qwell blends immediate online access to experienced counsellors and wellbeing practitioners through 1-2-1 chat and messaging functionality, alongside digital self-help tools including journals, goal trackers and mini activities, a pre-moderated (nothing is published to our site without being stringently reviewed by a member of our safety team), an active community delivering peer support through discussion posts, live forums based on current presenting issues and an extensive library of peer and professional created content.

Qwell’s aim is to deliver equitable, appropriate, and timely services to those who need them the most. With this in mind, it has created an upstream accessible mental health service with clinically-evidenced impact delivered at a whole population level. At the heart of our person-centred approach is a commitment to clinical excellence, digital best practice and inclusivity. There are no thresholds for support and no waiting lists. Qwell’s free, safe and accessible service is currently available to more than 8.9m adults through our qwell.io platform.

Such a widely used service provides a broad base of evidence that demonstrates the positive impact of early intervention and prevention in mental health outcomes. It is also an invaluable source of data for identifying trends in the mental health concerns of adults that we share with our partners to support a more proactive engagement and understanding of trends in their region and across the UK. Qwell has proven it is possible to deliver outcomes at scale to a population, achieving the outcomes that individuals want and need from mental health support. Qwell bridges the gap between academic evidence and real world experience and is proving the impact of early intervention and prevention in mental health. We deliver pioneering research and work to establish the evidence base for Qwell to contribute to best practice in digital mental health innovation - this is really important to us. We have innovated in developing bespoke clinically-validated measures around peer to peer interaction and our single session therapeutic model.

Please see our website for more details.

Clinical model

Qwell is designed to meet the Thrive Framework for System Change (Wolpert et al 2019). Our platform is unique in that it works with service users who may need advice and signposting, help, more ongoing help or immediate risk support. Our clinical model is NICE informed and we have ongoing pathways mapped across the UK.

Accessible and Age Appropriate

Our platform has been designed over the past 15 years with service users. We know how they want to access services, what they want to know and how they want to engage. We are focussed on ensuring all aspects of the platform meet the Web Accessibility Guidelines (WCAG) 2.1 level AA.

Anonymous and Available

Qwell is an anonymous digital platform which helps users to feel safe and confident in exploring their concerns and seeking professional support. Access to the Qwell platform is 24/7, 365 days a year, with practitioner support available during afternoons, evenings and over weekends / bank holidays.

Human Practitioners

Our live chat functionality allows service users to receive professional support through either booked or drop-in sessions as and when a session is required. Our qualified practitioners are real people, not bots, with significant experience in working with service users.

Multiple Ways to Get Help

Qwell enables individuals to access a range of tools and interventions to support their individual wants and needs. This approach spans self-therapy, community support and professional support (including counselling). It demonstrates the “one size does not fit all” approach that we view as fundamental to empowering individuals to take control of their mental health. Each component can be accessed as a stand alone or as part of a wider care package.

No Waiting Lists or Referrals

Access to Qwell is immediate. There is no need for a referral, no waiting lists and the service is available 24/7.

Risk and Safety

Managing risk is what we do. We have a robust risk profiling system across all parts of the platform that allows us to prioritise and to reach out. Safeguarding encompasses all we do at every level of care. We know when to signpost and refer on and how to psychologically hold people and keep them safe during a crisis.

Data Backup and Restore

Qwell uses the Google Cloud Platform for infrastructure, hosting and data. Qwell uses the europe-west-2 region (London) within GCP for additional details see:

https://cloud.google.com/about/locations/london. Google Cloud Platform is accredited to ISO27001, for additional compliance see: https://cloud.google.com/security/compliance. Qwell’s databases are backed up nightly. Data is backed up to multiple sites for redundancy. Data is encrypted and only accessible to engineering staff who have been through Qwell’s engineering on-boarding process. Back-ups are taken before key maintenance is applied to databases. Back-up and restore processes are automated, the process is tested at least once a year, in practice it is continually tested as part of the Google Cloud Platform.

Disaster Recovery - Business Continuity and Disaster Recovery Plans

Qwell’s service infrastructure is run on Google Cloud Platform (GCP) and provisioned across three availability zones. Each zone runs separate physical infrastructure and is resilient to other zones becoming unavailable. Qwell’s data infrastructure is run on GCP (Cloud SQL) and configured to be high availability. Each database runs with an active master and a passive standby in different availability zones. Data is replicated at a disk level between the zones. In the event of the master failing (e.g. due to utility failure) the database would fail over to the stand-by zone and continue running. All services are run in Google Cloud data centres with redundant power supplies and back-up generators.

For incidents occurring on the site itself, an on-call team of engineers are available at all times to ensure the continued proper function of the site. Customers will be regularly informed of incidents and outages that have affected the system after the fact. For planned outages, customers will receive two weeks notice in advance.

Onboarding and Offboarding Support - Mobilising Qwell

Platform set up

The product is already built and in use with an established technology infrastructure, no additional input will be required for mobilising each contract.

Accessibility

Qwell is available to all adults. We will work with local clinicians, community services to discuss support for those who have limited digital accessibility. Through a collaborative approach we will identify community-based solutions to help overcome digital poverty and support adults to engage with Qwell. Qwell and all our platforms are WCAG1.2AA accredited.

Stakeholder and service-user engagement

Key links will be made with the relevant Communications Leads with the Collaborative Commissioning Forum.

We will:

Lead stakeholder and service user engagement events.

Prepare a robust marketing plan for implementation, promoting Qwell through social-media and in public facing assets.

Build positive relationships with local services to ensure pathways are established.

Support colleagues in NHS Talking Therapies with information and advice about how to access Qwell for sub-threshold presentation.

Work with the commissioner to gather organisational contacts, identify localities and service user cohorts for priority post launch for targeted engagement and promotion.

Recruitment and Training

Our experienced Senior Regional Managers, Relationship Managers and Engagement Leads are in post and able to continue this service seamlessly.

Our service delivery team is national, and therefore able to manage fluctuating demand across contracts or onboarding new contracts.

Data collection and outcome monitoring

Our data collection and reporting systems are fully built and will support this contract immediately. We will continue to provide detailed quarterly reports as agreed on a monthly and quarterly basis, accompanied by contract review meetings.

Offboarding Support

Offboarding is a technically simple process for Qwell as a Commercial off-the-shelf (COTS) product. If a commissioning authority decides to decommission Qwell, the platform itself can be adjusted to no longer contain the locations and sublocations for the specific region in which Qwell was previously commissioned.

For service users, the process is more sensitive and complex. Initially the site will no longer accept new registrations for the specific locations while existing Service Users are slowly off boarded to other local services that align with their specific needs. Service User data will also be deleted to ensure compliance with GDPR.

Service Constraints - Maintenance Windows & Customisation

Qwell is a standalone, cloud-based online platform that is marketed as a holistic package to all commissioning authorities. It is iteratively developed with no specifically allocated maintenance windows. Customisation extends to the co-production of locations and sub-locations for specific regions with the commissioning authority, allowing users to select from a range of regions, as well as customisable landing pages for specific regions and authorities. This improves data collections and reporting accuracy for commissioning bodies, as well as the bespoke and official feel of the site for service users.

Service Levels - Performance, Availability and Support Hours

Qwell does not commit to specific Service Level Agreements (SLAs) for our service. We do however use SLO (service level objectives.) Our SLO for the core service is 99.65% availability across a seven-day period. This is equivalent to a single five-minute outage per day. In practice our availability never falls below 99.95%. During core service hours we maintain higher levels of availability, in practice. Our response time for an alert is 10 minutes for a P1 during service hours and 30 minutes for a P1 during all other times.

We run our services as high availability which ensures that data and other resources are stored across at least two availability zones within the Google Cloud Platform region. Qwell data is hosted in the europe-west-2 region (London) of the Google Cloud Platform. Data hosted at this location is used for service delivery.

After Sales Support

Once fully integrated in a local area, commissioning authorities receive quarterly reports on the performance of the contract. These reports provide data-rich insights into the mental health landscape of their area and help to iterate and develop the support and promotion locally. This is done in continual conversation with the commissioning authority and stakeholders to continue to help integrate and embed Qwell into local mental health service provision.

In terms of technical support, our IT and engineering teams are available at all times to mitigate against down time and respond to any issues arising within the Qwell ecosystem. Any issues are reported to commissioning authorities as soon as is feasibly possible.

Technical Requirements

Qwell has no technical requirements for the commissioning authority. Instead, the service simply requires the user to have an internet enabled device to access our service. This can be done on any type of device, including mobile and computer, and at any time.

Outage and Maintenance

Outage

Qwell’s databases run on the Google Cloud Platform. All databases containing production data are backed up in full nightly and also before any routine maintenance. Databases run in multiple availability regions resulting in separate back ups being stored in separate data centres.

While the specific locations of the data centres is a commercial and security secret for Google, they provide assurances and assessments that risks have been mitigated. In addition, our service is hosted across multiple availability zones to reduce the likelihood of an outage.

Maintenance

Qwell is a COTS (Commercial of-the-shelf) product and does not interface with Customer systems. Qwell is constantly improving the functionality of its products to ensure the best outcomes for service users in a way which minimises the impact to service delivery.

All changes are managed through Kooth’s quality management system (QMS).

In brief

- The purpose and scope of changes are agreed and documented in the QMS

- The changes are implemented against a development environment by a Kooth engineer or suitable contractor (who must have passed through the onboarding process). References to changed code or configuration are tracked via the QMS.

- Changes to application code or configuration are reviewed by another member of the engineering team. The reviewer and acceptance of the changes are tracked via the QMS.

- The same changes are programmatically applied to a test environment kept similar to production via automated configuration management

- Another member of the Product and Engineering team will perform quality assurance, testing the changes against the intended purpose and Kooth's cross-functional requirements. The acceptance of the changes will be recorded in the QMS.

- A product manager or internal customer will 'sign off' the changes in the QMS.

- Signed off changes are released to production environments via an automated process. The release is recorded in the QMS and in an external release log.

Customers will be regularly informed of incidents and outages that have affected the system after the fact.

For planned outages, customers will receive two weeks notice in advance.

All change records are kept permanently in a separate and securely maintained system. Changes are continuously developed and released. There is no notice period offered.

Hosting Options and Locations

Google Cloud Platform hosts all Kooth's services. Kooth uses Google Cloud Platform’s europe-west-2 region for hosting (London, UK). Data hosted at this location is used for service delivery. Kooth does not host any services or service data from our office locations.

Access to Data (Upon Exit)

Service user data is destroyed upon contract termination to ensure compliance with GDPR. ​​Restricted, confidential and sensitive information is disposed of securely in line with our commitments under the NHS Data Security and Protection Toolkit.

Security

Kooth Digital Health Limited is ISO27001 accredited by BSI Assurance Limited.

In transmission all data is encrypted using TLS v1.1 or higher. We are in the process of depreciating TLS v1.1 in favour of v1.2 and higher. All disks are encrypted by GCP to protect against loss of disks. Data with higher security levels is stored with a further layer of encryption, using AES-256.

Antivirus and antimalware is managed by our service provider Google Cloud platform (GCP). More information can be found on the GCP website.

Kooth provides equipment with appropriate controls before providing them to staff.

Kooth recognises that we are a potential target for cyber attacks and that a successful attack could lead to a data breach. We take the responsibility of our users’ data and the availability of our platform seriously and take a multi-layered approach to preventing security incidents.

As an anonymous service, the vast majority of data is non-identifiable. Any identifiable data shared by a user in a chat with a practitioner is stored in our proprietary counselling platform. This data is stored in GCP and encrypted in transit and at rest to the aforementioned standards.

We engage an external provider (Outpost 24) to test our technical systems for vulnerabilities at least once per quarter as well as performing larger-scale ad-hoc security tests. We use Google Cloud Armor and Cloudflare to provide protection against common attacks of opportunity on the public internet and monitoring to alert the engineering team to any such attack taking place, and have appropriate layers of network security in place. Sensitive data is encrypted at rest (using AES-256) and in transit (using industry-standard TLS).

High level overviews of our penetration testing results are available on request from Kooth.

Our IT policy ensures appropriate processes are in place for topics such as information governance, security training, GDPR compliance and on- and off-boarding for staff. In the event a breach should occur, we have a comprehensive data breach policy (DP-06 Kooth Data Breach Policy) to follow in line with GDPR requirements. We avoid collecting personally identifiable information about our users where possible which reduces the impact of data breaches. We monitor the usage of our enterprise data storage for any potential accidental or malicious leaks of data.