Sotender application for allocating social services and health care gig work

The benefits to be achieved through the product 

Sotender is a gig job application that aims to reduce labour costs, improve the availability of nursing staff, and increase the well-being and quality of life of workers at work. [1] 

Sotender brings employers and employees together to the same digital platform. Social services and health care workers interested in working for wellbeing services counties on a temporary basis register as Sotender users. The human resources unit of the wellbeing services county will be informed of the registration and will invite the employee in for an interview. In the context of the interview, the employee’s documents are reviewed and their special expertise investigated. After being admitted as a job seeker, the employee can choose locations suitable for them to work at, view currently open shifts, and receive notifications of new open shifts directly to the application. [1] 

Research evidence relating to the product under evaluation 

The resource management services of the Wellbeing Services County of Ostrobothnia began using Sotender as a pilot project at the end of 2022 and expanded it to the entire wellbeing services county by the end of 2023. The Vaasa Hospital District switched to the wellbeing services county model earlier than other regions and has been operating as the Wellbeing Services County of Ostrobothnia since the beginning of 2022 [2]. Table 1 presents a comparison matrix of substitute employee recruitment in October 2022 and in October 2024, by which time the Sotender application was already in use across the entire wellbeing services county. [3] 

Table 1. Changes in the Wellbeing Services County of Ostrobothnia  

The cost of using substitute labour in the Wellbeing Services County of Ostrobothnia has decreased in October 2024 compared to October 2022. 73.6% of the employees booking temp shifts with the wellbeing services county were persons other than those already employed by the county. A majority of gig shifts were allocated to employees external to the county, allowing the county to achieve savings in total payroll expenses through less overtime and urgent work compensation paid. The use of temporary work agencies to recruit substitutes and costs incurred in communication (text messages, WhatsApp) have almost entirely ceased by October 2024. More supervisor working hours have become available for other uses since Sotender was introduced, and it has been possible to reduce the number of secretaries and recruiters. [3] 

Hammare’s thesis examined how data related to health care gig work can be utilised in knowledge-based management, how this data should be visualised, and how the Sotender application can support this process. The study was carried out using a multi-dimensional approach combining qualitative and quantitative methods. The materials were collected by means of semi-structured interviews and electronic questionnaires of those working in managerial and supervisory positions within the health care services. Six people were interviewed in the course of the thesis work and an electronic questionnaire was also sent to them. Four people replied to the questionnaire and the responses were collected anonymously. [4] 

The interviewees and respondents were of the opinion that the information gathered by Sotender can be utilised [4] 

• in mapping out, developing, and reporting on operations 

• in assessing the volume and positioning of recruitment needs 

• in assessing the success of recruitment 

• in developing the employer’s image and brand 

• in data visualisation.  

Participants hoped that the visualisation could be implemented in a way that enabled organisations themselves to compile reports for their own, varying purposes [4]. 

Literature reviews 

According to the literature review, the well-being of social services and health care professionals at work and the improvement of their quality of life are influenced by a wide variety of factors [5]. Supporting well-being at work in a comprehensive fashion requires both individual and organizational measures. Individual interventions are effective in the short term, but the long-term prevention of burn-out and sustained improvements in well-being at work require organisational changes, such as workload management and structural reforms. In future studies, it would be crucial to focus on measures at the organisational level that serve to pre-empt issues and to support the coping of health care workers. Furthermore, studies are needed that make use of control groups and ensure that the impacts of well-being are monitored also after the interventions have concluded. [6] 

The company makes use of a risk analysis, which is regularly updated. The risk analysis of the product has identified possible safety risks and the means to minimise them. Attempts have been made to prevent incorrect operation through user training, user interface design, and user feedback monitoring. [1]   

The risk management plan defines the processes the integrity of which is ensured by the safety of the product. Notifications pertaining to safety issues are processed through a separate support channel. [1] 

The company has a designated person responsible for the safety of the product.  

According to information received from the company, the product has not caused any safety incidents or other anomalies impacting the safety of the customers. [1] 

The service needs an internet connection to function. [1] 

The Wellbeing Services County of Ostrobothnia has drawn up a cost calculation [3] of the actual costs incurred in using the product, on which this assessment is based. 

The cost depends on the size of the client organisation [1].  

The use of the product is subject to an initial fee including training and deployment costs [1].  

The continued use of the product is subject to a monthly fee including [1] 

• maintenance 

• updates 

• collection of data 

Integration with other systems such as HR, payroll, shift planning, and recruitment systems may incur additional costs. Further development of the product, customer-specific process development with the key client, may incur additional costs. [1]  

The use of the product is free of charge for the employee [1].  

On the basis of the information provided by the manufacturer, it appears that the cost of using the product is reasonable in relation to the benefits to the organisation [1,3]. 

The information security and data protection requirement database for purchases by the social care and health care services, as well as response material delivered by Koivu Solutions Oy, have been used in the evaluation [1,7]. 

Risk management and data security testing 

Risk management is actively maintained with a clear focus on data security and protection. The processing of security incidents and the management of the consequences of risks are documented. Automated and manual data security testing is carried out both internally and by an external third party. 

Log management 

Log data on all activities and changes are collected and actively monitored, and their management is supervised and role-based. Log data management is implemented using Google Cloud Platform (GCP) policies and platform tools. Log data is stored in Finland. 

User management 

User authentication is outsourced to Google and Microsoft services. Creating a password on the platform, if necessary, has been implemented with Google identity Platform and will not be stored in the company database. The service supports multi-stage identification and Federated Identity and makes use of role-based user management. 

Hardware 

The product is implemented as Software as a Service (SaaS) implemented using the Koivu Cloud solution by the same company. End-users, i.e. internal and external employees within the customer organisation, use their personal devices to access the service either through a mobile app or through a web browser.  

Data protection 

The information is protected at rest and during transfer in accordance with the current applicable standards. 

Data governed by the General Data Protection Regulation (GDPR) will be stored in Google data centres in Finland and Belgium in accordance with the GDPR. Authentication, mobile messages, and e-mails are transmitted through services whose servers are located in the United States. The services are reportedly compliant with GDPR regulations. 

A high-quality Data Protection Impact Assessment (DPIA)template has been created for the product that can be used by client acting as the data controller.  

Encryption algorithms and practices conform to modern recommendations. 

The company acts as the data processor and the client organisation acts as the controller. 

General guidance on procurement  

During the purchase phase it is always important to contact the IT management, data security specialist and data protection specialist of the organisation. Please discuss with them whether the product in question fulfils your requirements. In addition, we recommend that the wellbeing services counties utilise the European Union Agency for Cybersecurity’s (ENISA) data security procurement guidelines as support in the procurements [8]. 

Sotender is a Progressive Web Application (PWA) for social services and health care professionals packaged as a native app and made available through the Android and iOS app stores [1].  

• The iOS and Android versions of the application follow the design guidelines specified for those platforms.  

• Where applicable, the PWA meets the requirements of the Google PWA checklist. 

Usability 

According to the manufacturer, the development of the usability and accessibility of the product is a continuous process and has been developed through engaging end-users. In the development stage, user questionnaires and follow-up meetings with clients organised every two weeks have been utilised. Usability has been further improved based on collected feedback. No separate usability testing has been performed on the product. [1] 

Accessibility 

The product has undergone an accessibility assessment carried out by the developer itself. The product meets the technical accessibility requirements defined in the European standard EN 301 549. [9.10] The accessibility status of the product is laid out in the accessibility statement for the product available on the manufacturer’s website [10]. According to information provided by the company, the following specific user groups have been taken into account in the design of the usability and accessibility of the product: [1]  

• Abnormal colour vision: The app offers alternative ways to express features. 

• Missing or incomplete Finnish skills: The software contains a frequently asked questions module that provides translations if its content implemented through AI for most languages.  

• Cognitive challenges: Use of the app does not require remembering previous actions, and stress levels induced by the app are minimised. There are no complex dialogue chains in the application.  

• Fine motor issues: The product can be accessed on a mobile device as well as on a computer while using assistive devices.  

Feedback on the accessibility of the product can be provided through the application’s internal feedback channel. According to the company, it will respond to the feedback within 14 days. [1] 

General guidance on procurement  

The purchasing organisation shall take into account the accessibility requirements set out in the legislation in force at the time [9,10,12]. 

Interoperability 

The product integrates with client-specific systems such as HR, payroll, recruitment, and shift planning software. The data generated by the product can be migrated in JSON and Excel file formats. [1]  

Technical functionality 

All source code and setup files are subject to version management and audit processes. The company’s testing processes for the product have been defined in advance and are being implemented as part of product development. The company receives and processes any product-related error messages through log data as well as automated alerts derived from log data. Error messages received by users are processed via e-mail and the application’s internal form. [1] 

The product does not provide the possibility to revert to an earlier version because all users use the same version. However, clients are free to decide which functionalities the product offers. [1] 

The company is proactive in monitoring the product’s performance to detect potential faults by making use of automated scanning as well as following key industry reports and best practices. [1] 

The company has made no plans for decommissioning the product. However, all data in the system can be easily moved to the Microsoft Excel format. [1] 

According to the manufacturer, there have been no outages in the service, and the service has not been disabled due to a failure in the last six months. [1] 

The product is updated through an automated process. Updating the product will not cause any downtime. The software automatically informs end-users about available product updates. The company will inform the users of the product about any planned interruptions to the service at least 10 days in advance. [1]  

Observations related to artificial intelligence 

A functionality based on an artificial intelligence model is being developed for the product to assist in induction into workplace practices, with the exception of patient care practices. This functionality has not been included in this assessment. [1] 

Training and product support 

The company offers product support by phone and email during office hours. During the deployment phase, the company will offer introductory training in Finnish and, if necessary, also in English. The training includes an initial training package, which is provided to employers as two half-day training sessions. One additional training session will be organised for administrators. According to the company, the employees do not need any training in the use of the product. Pre-prepared instructions for the purchaser organisation to support the deployment are available. Instructions for using the product are available online in Finnish. [1] 

Product distribution 

At the time of this assessment, the product has been in use for two years. It is in use, for example, in the wellbeing services counties of Ostrobothnia, Satakunta, Central Ostrobothnia, and Päijät-Häme as well as in a total of over ten different organisations. [1] 

1. The Digi-JHTA questionnaire filled out by the company, not public information. 
2. In Ostrobothnia, the transition is being made from a joint municipal authority to a self-governing welfare region. Available at: https://pohjanmaanhyvinvointi.fi/pohjanmaalla-siirrytaan-kuntayhtymasta-itsehallinnolliseksi-hyvinvointialueeksi/. Accessed on 20.2.2025 
3. Sotenderin effectiveness evaluation. Pohjanmaan well-being services county 7.2.2025, not public information. 
4. Hammaren M. 2023. Terveydenhuollon tiedolla johtaminen keikkatyön tapahtumatiedon avulla. Opinnäytetyö, ylempi AMK. https://urn.fi/URN:NBN:fi:amk-2023121135887  
5. Xiao, Q., Cooke, F. L., & Chen, L. (2022). Nurses’ well‐being and implications for human resource management: a systematic literature review. International Journal of Management Reviews, 24(4), 599-624. https://doi.org/10.1111/ijmr.12295   
6. Cohen C, Pignata S, Bezak E, et al Workplace interventions to improve well-being and reduce burnout for nurses, physicians and allied healthcare professionals: a systematic review BMJ Open 2023;13:e071203. https://doi.org/10.1136/bmjopen-2022-071203  
7. National Cyber Security Centre: Information security and data protection requirements for social welfare and healthcare procurements. Available at: https://www.kyberturvallisuuskeskus.fi/en/ncsc-news/instructions-and-guides/information-security-and-data-protection-requirements-social Accessed on 19.2.2025 
8. The European Union Agency for Cybersecurity Procurement Guidelines for Cybersecurity in Hospitals. Saatavilla: https://www.enisa.europa.eu/publications/good-practices-for-the-security-of-healthcare-services. Accessed on 19.2.2025 
9. Act on the Provision of Digital Services 306/2019 (Available only in Finnish). Available at: https://www.finlex.fi/fi/laki/alkup/2019/20190306  Accessed on 19.2.2025 
10. Requirements of the Act on the provision of Digital Services. Available at:https://saavutettavuusvaatimukset.fi/en/requirements-act-provision-digital-services/requirements-act-provision-digital-services Accessed on 19.2.2025 
11. Sotender– Accessibility statement. Available at https://sotender.fi/saavutettavuusseloste/. Accessed on 19.2.2025 
12. Act on public Procurement and concession contracts 1397/2016 (Available only in Finnish). Available at: https://www.finlex.fi/fi/laki/alkup/2016/20161397 Accessed on 19.2.2025 

Jari Haverinen, erikoissuunnittelija, FinCCHTA 

Raija Järvinen, erikoissuunnittelija, FinCCHTA 

Teemu Mustola, erikoissuunnittelija, FinCCHTA 

Tommi Hanhela, tietoturva-asiantuntija, Oulun yliopisto 

Jere Kinnunen, tietoturva-asiantuntija, Oulun yliopisto 

Antti Koskela, tietoturva-asiantuntija, Oulun yliopisto