ATMP vein-to-vein custody chain — a lost CAR-T is not an incident, it is a patient without treatment.

The problem

One missing reading and the product stops being “this patient”.

The autologous ATMP is the extreme case of pharma traceability: the medicine is the patient. If the custody chain breaks between apheresis and infusion, there is no substitute batch and no recall that helps — there is a sick person waiting for a treatment that can no longer be delivered. And a broken chain is almost never down to bad faith; it comes from these causes:

1. Hand-offs between systems that do not talk to each other — the origin hospital's HIS, the manufacturer's LIMS, the cryogenic courier's system and the destination hospital's HIS, each with its own naming conventions. The patient-product identity gets rebuilt by email, by spreadsheet or over the phone.
2. Documentation that arrives late — the qualified person signs with whatever they have; if the shipper's datalogger is downloaded at destination and the curve is broken, it is already too late.
3. Outside events that nobody integrates at second zero — a flight delay, a change in hospital scheduling, an incident at the courier. They arrive by WhatsApp, by email, by phone call, and people find out when there is no margin left.

The operator, the qualified person and the hospital coordinator all know this. They do not fail out of carelessness — they fail because this information was never joined up, and on the day their systems were designed there was no affordable way to join it.

How it fits the IRIS system

iLEAN does not replace the LIMS, the HIS or the courier — it seals the cracks between the three.

The vein-to-vein challenge is not a lack of technology in each link: every one of them has its own. The problem is the putty between them, the dead zones where the patient-product identity loses its signature as the data passes from one system to the next. That is where iLEAN comes in, without asking you to change your LIMS or the partner hospital's HIS.

Tracer keeps the patient-product ID alive at every milestone. Connect captures outside events at second zero. The agents consolidate the dossier and warn before — not after — something stops adding up.

The three iLEAN pieces applied to the ATMP custody chain:

• Tracer (Edge + traceability agents) — a terminal with vision and label reading at every critical milestone: apheresis, receipt at manufacturing, cryogenic shipping, receipt at the hospital, infusion. Every reading cross-references the patient-product ID and, if it is missing or does not match, holds the shipment right then — not in the audit afterwards.
• Connect — captures the data from the shippers' dataloggers (temperature, opening events, GPS), the specialist courier's communications, the hospital coordinator's email and the hospital HIS events, whether they arrive via modern HL7/FHIR or as a form the nurse fills in by hand in the apheresis room. The information reaches the system at second zero, with nobody forwarding anything or calling a meeting.
• Writer agent — consolidates the vein-to-vein file per patient with every milestone cryptographically signed, ready for inspection by the EMA, the FDA or a national authority. It does not rebuild after the fact — it writes the dossier while the chain moves, and if something drifts it alerts the qualified person through whichever channel they use, before the problem grows.

See the full IRIS architecture →

Before and after

ATMP custody by email and spreadsheet vs. a live chain with iLEAN

Aspect	Manual custody + isolated systems	With iLEAN Tracer + Connect + Writer
Patient-product ID	Rebuilt by email between hospital and manufacturer	Unique, carried through and verified at every milestone
Cryogenic datalogger	Downloaded at the end, at destination	Captured in real time, alert before the deviation
Communication with the courier	WhatsApp and email forwarded to several people	Connect integrates the channel, events at second zero
Dossier for EMA/FDA	Rebuilt at the end, over days or weeks	Living file per patient, signed, exportable
Deviation detection	Once it has already failed — and the patient is waiting	The agent alerts the qualified person as soon as it drifts
Integration with the hospital HIS	“Let the hospital change” (it is not going to happen)	iLEAN adapts to the hospital's HIS, not the other way round

Impact estimate

Impact estimate for your plant — to be validated with your numbers.

The block below is an estimate to be validated with the specific data of your program. We put it forward so the committee has an order of magnitude; we refine it during the diagnostic.

• Autologous CAR-T program with 2-5 partner hospitals, a specialist cryogenic courier and centralized manufacturing.
• Tracer + Connect pilot at one partner hospital plus the shipping leg (reading at every milestone, real-time datalogger, minimal integration with the LIMS and the HIS). First value expected within a few weeks.
• Indicative payback between 4 and 9 months, depending on patient volume and the cost of lost hand-offs (batches quarantined for broken traceability, flights missed because documentation ran late, infusions rescheduled).
• A ≥30% reduction in hand-off dead time and elimination of the risk of losing patient-product identity in a documented hand-off — the hard lever is zero patients whose treatment is lost to a broken trace.

And the qualified person's reasonable doubt

“What if the AI gets it wrong and signs off a shipment it should not have?” — hallucination is a problem of free generation, not of anchored tasks. In tasks where the AI merely cross-references readings against a unique identifier and packages the evidence, the best models brought error below 1.5% ^[1]. And even so, in ATMP nothing critical is decided alone: the three safety rings ensure the qualified person's signature remains mandatory — the AI proposes, the person releases. See the architecture.

^[1] OpenAI paper “Why Language Models Hallucinate”, 2025 — on the reliability of AI in anchored tasks.