One patient. One operational case. From treatment order to treatment readiness.

An autologous therapy is not a batch that happens to belong to a patient. It is a patient-specific operating case with a finite clock. The case begins with an authorized treatment order and ends when the released product is received into the correct treatment workflow.

Seal can own that case end to end. Patient orchestration, chain of identity and custody, electronic batch execution, material genealogy, QC and environmental testing, equipment evidence, quality events, CoA, release, and return operate on one data model. If another system is deliberately retained, its authority and interface are explicit; it is not a prerequisite for the Seal operating model.

A treatment order creates the governed case: product, treatment centre, planned dates, collection requirements, chain-of-identity token, permitted patient attributes, responsible roles, and current state. Scheduling then resolves the collection slot, courier lane, manufacturing suite, equipment, qualified people, material availability, laboratory capacity, release window, cryogenic storage, and treatment-centre readiness around that case.

Treatment centres, coordinators, logistics teams, manufacturing, QC, and QA receive role-appropriate views of the same state. A schedule change preserves the prior plan, reason, approval, downstream acknowledgement, and effect on the remaining vein-to-vein window. The status presented outside manufacturing is therefore governed by operational evidence, not copied into a parallel tracker.

The therapy case uses controlled pseudonymous identifiers in operational views. Authorized roles receive only the patient context required for safe work; access to protected identity, resolution events, failed checks, and changes remains audited.

Chain of identity permanently relates the authorized patient, collection, starting material, every intermediate and sample, final product, shipment, and treatment-centre handoff. Chain of custody records who controlled each physical object, where, when, in what condition, and with what acknowledgement. At every critical handoff, the expected identifiers and physical object are verified. A mismatch blocks normal progression and opens containment; printing, relabelling, identifier replacement, and manual recovery preserve the prior value and reason.

Starting-material receipt is an eligibility gate. Identity, custody, collection time, container, seals, condition history, quantity, cell count, documents, and acceptance criteria determine whether processing can begin. Borderline or nonconforming material retains the observed state and follows the approved decision path for continued manufacture, rescue, recollection, or cancellation.

The electronic batch record controls the governing process version, calculations, limits, timers, decision tables, branches, repeat operations, signatures, materials, equipment, samples, and exceptions. Variable starting material may select an approved path; it does not permit free-form improvisation. Each executed branch retains its source condition, governing rule, decision authority, and effect on the patient-specific clock.

Equipment qualification, calibration, maintenance, cleaning, software, and availability gate the relevant step. Personnel need current procedural, aseptic, equipment, task, and practical qualification. If eligibility later becomes unacceptable, the same records identify every affected therapy case since the last known acceptable state.

Media, cytokines, beads, vectors, reagents, bags, tubing, filters, labels, and cryopreservation materials remain linked to the patient lot. Receipt, internal transfer, cleanroom movement, sampling, splitting, pooling, loss, cryogenic storage, pack-out, dispatch, and treatment-centre receipt remain explicit events. Each transfer records source and destination objects, quantity, user or system, place, time, condition, and acknowledgement.

A component concern can trace forward to every affected therapy case. Sampling and discard remain genealogy events rather than unexplained reductions. Controlled-rate freezing, storage location, freezer program, transfers, temperature evidence, excursions, shipper preparation, logger, route, and receipt remain attached to the final product. Restored temperature does not erase prior exposure.

Connection design begins with the actual vendor, model, software, output, network location, and intended record. Cell washers and separators, cell counters, incubators, bioreactors, flow cytometers, balances, pH meters, environmental monitors, and controlled-rate freezers retain their appropriate native controls.

Where the equipment supports it, Seal can collect through an API, OPC-UA, network or file share, FTP, serial gateway, historian, or a local edge service. The captured evidence retains the source file or reference, checksum where applicable, instrument, method or recipe, configuration, operator, timestamp, units, and patient-lot, step, container, or sample context.

Every connection specifies acknowledgement, retry, clock handling, completeness checks, review, and a governed manual fallback. If the connection fails, the record shows the gap; it does not silently substitute transcription.

Manufacturing creates in-process and release samples with source container, collection time, priority, test panel, method, limits, and waiting decision attached. Cell count, viability, identity, purity, potency-related measures, microbiology, vector copy, and other product-specific tests return to the exact step they govern.

Environmental samples and monitoring events retain room, location, session, activity, limits, incubation or instrument evidence, result, excursion, and affected manufacturing window. Seal can run these laboratory workflows together while keeping specifications, methods, review states, invalidity, OOS, and raw-data references explicit.

With Seal QMS, a deviation opens from the exact patient lot, process step, equipment, sample, result, source evidence, and time that triggered it. Investigation, OOS, CAPA, change control, effectiveness, and disposition operate on the same objects used by EBR and LIMS. Quality receives the context automatically because there is no system boundary to cross.

Where another QMS remains authoritative, Seal sends the event context and source evidence, retains the external reference, receives the approved outcome, and uses that outcome to gate execution or release. The same rule applies to every retained system: one authority for each state, versioned messages, acknowledgement, retry, error handling, reconciliation, and audit evidence.

Release evidence assembles continuously rather than through a final document hunt. Seal evaluates execution, identity and custody, genealogy, equipment and personnel eligibility, environmental evidence, laboratory results, quality events, reconciliation, container state, labels, storage, and outstanding actions as the patient lot progresses.

The approved specification and reviewed results generate the CoA from governed data. Disposition records what was reviewed, by whom, under which version, with which conditions and signatures. Pending evidence never appears as passed.

Final labelling renders from governed product, case, container, storage, expiry, and permitted identity data. Dispatch verifies released state, destination, treatment schedule, shipper, route, courier, documents, and contingency. Treatment-centre receipt records time, condition, identifiers, seal, storage, receiver, and discrepancy before the case reaches treatment readiness. Seal governs the operational handoff; it does not replace clinical administration or medical judgement.

Identity discrepancy, insufficient starting material, contamination concern, growth failure, missed process window, equipment outage, failed test, environmental excursion, cryogenic excursion, courier delay, or treatment reschedule all require a coordinated response.

The event opens with the therapy case, affected physical material, schedule, evidence, remaining window, and responsible roles attached. Actions and messages remain time-stamped and acknowledged. Milestones distinguish planned, dispatched, received, accepted, completed, failed, and cancelled states. Treatment centres, collection sites, couriers, manufacturing, laboratories, quality, and storage providers receive the governed status they need without email becoming the operating model.

The proof includes an identity mismatch, schedule change, borderline receipt, process branch, equipment-data failure, missing or OOS result, environmental or cryogenic excursion, courier delay, recollection, and cancellation. The system is ready when every path preserves identity, custody, evidence, time, and accountable decision.