CyberLiver DTAC Responses

Updated date: 27 June 2024

The Digital Technology Assessment Criteria for health and social care (DTAC) gives, healthcare providers, patients and citizens confidence that the digital health tools they use meet clinical safety, data protection, technical security, usability and accessibility standards. The DTAC brings together UK legislation and good practice in these areas, providing new national baseline criteria for digital health technologies entering into the NHS and social care.

ETHOS, world leaders in digital health technology evaluation have assessed CyberLiver against DTAC and certified it as compliant with the criteria.

PDF Download | CyberLiver DTAC Certificate DTAC Compliance

Clinical Safety

We are compliant with the DCB0129 standard for Clinical Safety having assessed and mitigated safety hazards relating to the CyberLiver platform. Our approach to Clinical Safety is underpinned by our Clinical Risk Management plan and articulated in the Clinical Safety Case Reports.

CyberLiver’s Digital Medicine Platform is a configurable, modular Software as a Medical Device (SaMD) designed for the monitoring, diagnosis, treatment, or management of patients with various disease conditions. It is UKCA marked Class IIa medical device and FDA BDD. We have a declaration of conformity for this and are registered with the MHRA.

Data Protection

We have met the standards of the NHS Data Security and Protection Toolkit (DSPT), have a Data Protection Officer in place and are registered with the Information Commissioner’s Office. We process all data within the United Kingdom and are GDPR compliant.

Technical Security

CyberLiver are Cyber Essentials certified, run penetration testing at least once annually and have load tested the CyberLiver Platform.

Usability

Users of the product and patients are consulted as part of the development process for the CyberLiver Platform. This is done through a mixture of one to one communication with customers and focus groups of patients. We are committed to taking continual feedback from our customers and focus groups to ensure our product remains aligned to user needs.

Accessibility

CyberLiver are committed to achieving WCAG 2.1 AA compliance and are currently working towards this. Read our accessibility statement.

Ongoing DTAC compliance

For every new release of the CyberLiver Platform, we maintain and update our documentation in the above areas, filtering this into our DTAC submission so that it is always up-to-date.

A. Company Information

Code

DTAC Question

Provide the name of your company

CyberLiver Response

CyberLiver Limited

CODE

DTAC QUESTION

Provide the name of your product

CyberLiver Response

CL-II Platform

CODE

DTAC QUESTION

Provide the type of product

CyberLiver Response

App

CODE

DTAC QUESTION

Provide the name and job title of the individual who will be the key contact at your organisation

CyberLiver Response

Ravi Kumar, Chief Executive Officer

CODE

DTAC QUESTION

Provide the key contact's email address

CyberLiver Response

[email protected]

CODE

DTAC QUESTION

Provide the key contact's phone number

CyberLiver Response

+ 44 (0)7970 002 610

CODE

DTAC QUESTION

Provide the registered address of your company

CyberLiver Response

First Floor, Burnells, 5 Garland Road, Stanmore, Middlesex, HA7 1NR

CODE

DTAC QUESTION

In which country is your organisation registered?

CyberLiver Response

United Kingdom

CODE

DTAC QUESTION

If you have a Companies House registration in the UK please provide your number

CyberLiver Response

08052630

CODE

DTAC QUESTION

A10

If applicable, when was your last assessment from the Care Quality Commission (CQC)?

CyberLiver Response

Not applicable

CODE

DTAC QUESTION

A11

If applicable, provide your latest CQC report.

CyberLiver Response

Not applicable

B. Value Proposition

CODE

DTAC QUESTION

Who is this product intended to be used for?

CyberLiver Response

Patients

CODE

DTAC QUESTION

Provide a clear description of what the product is designed to do and of how it is expected to be used

CyberLiver Response

Intended use of CL-II Digital Medicine Platform: CyberLiver’s CL-II Digital Medicine Platform is a configurable, modular Software as a Medical Device (SaMD) designed for the monitoring, diagnosis, treatment, or management of patients with various disease conditions. This platform seamlessly integrates with digital sensors, wearables, patient-reported outcome measures (PROMs), lab results, and software programs to collect physiological and non-physiological patient-generated health data (PGHD) through mobile or web applications at regular intervals or on demand. The PGHD is analysed by proprietary algorithms that use machine learning and artificial intelligence techniques. These algorithms support CyberLiver’s Clinical Decision Support system (CDS) in detecting patterns, predicting outcomes, and generating recommendations. These recommendations are delivered to clinicians via a secure web app, portal, or mobile app, enabling informed clinical management decisions including dose-optimized pharmacological and non-pharmacological interventions personalized to the individual needs of patients, thereby advancing precision medicine in disease treatment.

Alcohol related Liver Disease (ArLD) Management: AlcoChange

Intended Use of AlcoChange: AlcoChange (trade name) is a Digital therapeutic intended to reduce alcohol use and maintain abstinence in individuals with established alcohol-related liver disease (ArLD).

Indications for Use of AlcoChange: AlcoChange is intended to increase abstinence and reduce alcohol use in patients with alcohol-related liver diseases (ARLD) by providing behavioural therapy based on CyberLiver Behaviour Change (CBC) Model that is designed from a blend of principles from various behaviour change theories in the design of Digital Behaviour Change Techniques (DBCTs), Digital Behaviour Change Interventions (DBCI’s) and Personalised Behaviour Change Notifications (BCN’s). AlcoChange is intended to provide behavioural therapy as an adjunct to a contingency management system, for patients 18 years of age and older who are currently enrolled in outpatient treatment under the supervision of a clinician. AlcoChange is indicated as a 12-week prescription-only treatment for patients with Alcohol Related Liver Disease.

Decompensated Cirrhosis Management: CirrhoCare

Intended Use of CirrhoCare: CirrhoCare (trade name) is a digital therapeutic intended for assisted diagnosis, recommendations and therapeutic intervention for the management of new complications of decompensated cirrhosis.

Indications for Use of CirrhoCare: CirrhoCare is intended for out-of-hospital specialist hepatology management follow-up of adult cirrhosis patients ages 22 and older. CirrhoCare is intended to identify new preventable decompensation events [such as dehydration (acute kidney injury), new accumulation of ascites, infection or hepatic encephalopathy] for a health care provider to take immediate clinical action, allowing the opportunity for early outpatient-based interventions. CirrhoCare is intended for active remote management for up to 3 months. In patients who remain stable on CirrhoCare for up to 3 months, a more standard medium-term outpatient clinical follow-up pathway can be resumed. For those who remain unstable or with signs of frequent new complications, management can be continued beyond 3 months.

CODE

DTAC QUESTION

Describe clearly the intended or proven benefits for users and confirm if / how the benefits have been validated

CyberLiver Response

Key Performance Claims of AlcoChange:

AlcoChange aids in reduction in alcohol use compared to baseline after 3 months
AlcoChange contributes to an increase in abstinence rates
AlcoChange-managed patients have improved their quality of life

Key Performance Claims of CirrhoCare:

CirrhoCare detects early signs (as early as 72 hours) of new decompensation complications and alerts for timely intervention
CirrhoCare-managed patients have reduced number of readmissions, reduced hospital visits and reduced length of stay in the hospital
CirrhoCare-managed patients have opportunity for reduced disease morbidity and severity
CirrhoCare-managed patients have improved their quality of life

CODE

DTAC QUESTION

Please attach one or more user journeys which were used in the development of this product. Where possible please also provide your data flows

CyberLiver Response

Documentation of user journeys and data flows available on request.

C. Technical Questions

CODE

DTAC QUESTION

C1.1

Have you undertaken Clinical Risk Management activities for this product which comply with DCB0129?

CyberLiver Response

Yes

CODE

DTAC QUESTION

C1.1.1

Please detail your clinical risk management system

CyberLiver Response

Clinical Risk Management System documentation available on request.

CODE

DTAC QUESTION

C1.1.2

Please supply your Clinical Safety Case Report and Hazard Log

CyberLiver Response

Clinical Safety Case Report and Hazard Log available on request.

CODE

DTAC QUESTION

C1.2

Please provide the name of your Clinical Safety Officer (CSO), their profession and registration details

CyberLiver Response

Pippa Gascon Crossley – Clinical Safety Officer, Registration reference number: GPhC 2057053

CODE

DTAC QUESTION

C1.3

If your product falls within the UK Medical Devices Regulations 2002, is it registered with the Medicines and Healthcare products Regulatory Agency (MHRA)?

CyberLiver Response

Yes

CODE

DTAC QUESTION

C1.3.1

If yes, please provide your MHRA registration number

CyberLiver Response

CirrhoCare: 66975 & AlcoChange: 66976

CODE

DTAC QUESTION

C1.3.2

If the UK Medical Device Regulations 2002 are applicable, please provide your Declaration of Conformity and, if applicable, certificate of conformity issued by a Notified Body / UK Approved Body

CyberLiver Response

Declaration of Conformity available on request

CODE

DTAC QUESTION

C1.4

Do you use or connect to any third-party products?

CyberLiver Response

Yes

CODE

DTAC QUESTION

C1.4.1

If yes, please attach relevant Clinical Risk Management documentation and conformity certificate

CyberLiver Response

Clinical Risk Management documentation and conformity certificate available on request

C2. Data Protection

CODE

DTAC QUESTION

C2.1

If you are required to register with the Information Commissioner, please attach evidence of a current registration.

CyberLiver Response

Evidence of registration with Information Commissioner is available on request.

CODE

DTAC QUESTION

C2.2

Do you have a nominated Data Protection Officer (DPO)?

CyberLiver Response

Yes

CODE

DTAC QUESTION

C2.2.1

If you are required to have a nominated Data Protection Officer, please provide their name.

CyberLiver Response

Anu Balaji, Data Protection Officer

CODE

DTAC QUESTION

C2.3

Does your product have access to any personally identifiable data or NHS held patient data?

CyberLiver Response

Yes

CODE

DTAC QUESTION

C2.3.1

Please confirm you are compliant (having standards met or exceeded status) with the annual Data Security and Protection Toolkit Assessment.

CyberLiver Response

Yes, exceeded status.

CODE

DTAC QUESTION

C2.3.2

Please attach the Data Protection Impact Assessment (DPIA) relating to the product.

CyberLiver Response

DPIA available on request.

CODE

DTAC QUESTION

C2.4

Please confirm your risk assessments and mitigations / access controls / system level security policies have been signed-off by your Data Protection Officer (if one is in place) or an accountable officer where exempt in question C2.2.

CyberLiver Response

Yes

CODE

DTAC QUESTION

C2.5

Please confirm where you store and process data (including any third-party products your product uses)

CyberLiver Response

UK only

CODE

DTAC QUESTION

C2.5.1

If you process store or process data outside of the UK, please name the country and set out how the arrangements are compliant with current legislation

CyberLiver Response

Not applicable

C3. Technical Security

CODE

DTAC QUESTION

C3.1

Please attach your Cyber Essentials Certificate

CyberLiver Response

Cyber Essentials Plus certificate available on request.

CODE

DTAC QUESTION

C3.2

Please provide the summary report of an external penetration test of the product that included Open Web Application Security Project (OWASP) Top 10 vulnerabilities from within the previous 12-month period.

CyberLiver Response

Compliant external penetration test summary report available on request.

CODE

DTAC QUESTION

C3.3

Please confirm whether all custom code had a security review.

CyberLiver Response

Yes

CODE

DTAC QUESTION

C3.4

Please confirm whether all privileged accounts have appropriate Multi-Factor Authentication (MFA)?

CyberLiver Response

Yes

CODE

DTAC QUESTION

C3.5

Please confirm whether logging and reporting requirements have been clearly defined.

CyberLiver Response

Yes

CODE

DTAC QUESTION

C3.6

Please confirm whether the product has been load tested

CyberLiver Response

Yes

C4. Interoperability Criteria

CODE

DTAC QUESTION

C4.1

Does your product expose any Application Programme Interfaces (API) or integration channels for other consumers?

CyberLiver Response

CODE

DTAC QUESTION

C4.1.1

If yes, please provide detail and evidence:

CyberLiver Response

The API’s (e.g., what they connect to) set out the healthcare standards of data interoperability e.g., Health Level Seven International (HL7) / Fast Healthcare Interoperability Resources (FHIR)
Confirm that they follow Government Digital Services Open API Best Practice
Confirm they are documented and freely available
Third parties have reasonable access to connect

CODE

DTAC QUESTION

C4.2

Do you use NHS number to identify patient record data?

CyberLiver Response

CODE

DTAC QUESTION

C4.3

Does your product have the capability for read/write operations with electronic health records (EHRs) using industry standards for secure interoperability (e.g. OAuth 2.0, TLS 1.2)

CyberLiver Response

CODE

DTAC QUESTION

C4.3.1

If yes, please detail the standard

CyberLiver Response

SSL/TLS server certificates are Amazon issued, Public key: RSA 2048-bit, Signature algorithm: SHA256WITHRSA.

Our AWS ELBs (Elastic Load Balancers) listen only for HTTPS connection requests. Elastic Load Balancing uses a security policy to negotiate SSL connections between a client and the load balancer. A security policy is a combination of protocols and ciphers that ensures that all data passed between the client and the load balancer is private.

The ELBSecurityPolicy-2016-08 security policy is always used for backend connections. For front-end connections we selected AWS Load Balancer ELBSecurityPolicy-FS-1-2-Res-2019-08. This is the most restrictive policy available. FS stands for Forward-Secrecy. This policy supports TLS 1.2 only and includes only ECDHE (PFS) and SHA256 or stronger (384) ciphers.

ELBs do not support SSL renegotiation for client or target connections.

We do NOT use oAuth.

CODE

DTAC QUESTION

C4.3.2

If no, please state the reasons and mitigations, methodology and security measures.

CyberLiver Response

Not applicable

CODE

DTAC QUESTION

C4.4

Is your product a wearable or device, or does it integrate with them?

CyberLiver Response

Yes

CODE

DTAC QUESTION

C4.4.1

If yes, provide evidence of how it complies with ISO/IEEE 11073 Personal Health Data (PHD) Standards.

CyberLiver Response

ISO/IEEE 11073 Personal Health Data (PHD) Standards available on request

D. Key Principles for Success

CODE

DTAC QUESTION

D1.1

Do you engage users in the development of the product?

CyberLiver Response

Yes

CODE

DTAC QUESTION

D1.2

Are all key user journeys mapped to ensure that the whole user problem is solved, or it is clear to users how it fits into their pathway or journey?

CyberLiver Response

Yes

CODE

DTAC QUESTION

D1.3

Do you undertake user acceptance testing to validate usability of the system?

CyberLiver Response

Yes

CODE

DTAC QUESTION

D1.4

Are you international Web Content Accessibility Guidelines (WCAG) 2.1 level AA compliant?

CyberLiver Response

Yes

CODE

DTAC QUESTION

D1.5

Does your team contain multidisciplinary skills?

CyberLiver Response

Yes

CODE

DTAC QUESTION

D1.6

Do you use agile ways of working to deliver your product?

CyberLiver Response

Yes

CODE

DTAC QUESTION

D1.7

Do you continuously develop your product?

CyberLiver Response

Yes – there is continuous development to improve user experience and engagement with the core therapeutic content.

CODE

DTAC QUESTION

D1.8

Do you have a benefits case that includes your objectives and the benefits you will be measuring and have metrics that you are tracking?

CyberLiver Response

Yes

CODE

DTAC QUESTION

D1.9

Does this product meet with NHS Cloud First Strategy?

CyberLiver Response

Yes - using AWS cloud

CODE

DTAC QUESTION

D1.9.1

Does this product meet the NHS Internet First Policy?

CyberLiver Response

Yes

CODE

DTAC QUESTION

D1.10

Are common components and patterns in use?

CyberLiver Response

Yes

CODE

DTAC QUESTION

D1.10.1

If yes, which common components and patterns have been used?

CyberLiver Response

We follow the NHS service manual guidance for Styles and patterns and the design guidelines below https://service-manual.nhs.uk/design-system/design-principles

CODE

DTAC QUESTION

D1.11

Do you provide a Service Level Agreement to all customers purchasing the product?

CyberLiver Response

Yes

CODE

DTAC QUESTION

D1.12

Do you report to customers on your performance with respect to support, system performance (response times) and availability (uptime) at a frequency required by your customers?

CyberLiver Response

Yes

CODE

DTAC QUESTION

D1.12.1

Please attach a copy of the information provided to customers

CyberLiver Response

Performance report information available on request.

CODE

DTAC QUESTION

D1.12.2

Please provide your average service availability for the past 12 months, as a percentage to two decimal places

CyberLiver Response

See Uptime Robot for service availability
cyberliver.com/platform-uptime

Digital Technology Assessment Criteria(DTAC)
for CyberLiver

Clinical Safety

Data Protection

Technical Security

Usability

Accessibility

Ongoing DTAC compliance

Our Responses to the DTAC Questions

Digital Technology Assessment Criteria(DTAC) for CyberLiver

Clinical Safety

Data Protection

Technical Security

Usability

Accessibility

Ongoing DTAC compliance

Our Responses to the DTAC Questions

Digital Technology Assessment Criteria(DTAC)
for CyberLiver