Autologous cell therapy software. One patient case from treatment order to treatment readiness.

An autologous therapy is better understood as a patient-specific case with a finite clock than as a batch that happens to belong to a patient. The case begins with an authorised treatment order and ends when the released product is received into the correct treatment workflow.

Seal can run that case end to end. Patient orchestration, chain of identity and custody, electronic batch execution, material genealogy, QC and environmental testing, equipment evidence, quality events, CoA, release and return operate on one data model. Where another system is deliberately retained, its authority and interface are explicit; it is not a prerequisite for the operating model. For clinic workflows, hospital access and site rollout, see the patient orchestration blueprint.

Why teams choose Seal for autologous therapy

In many autologous operations, a treatment centre asking where its patient’s lot stands is answered from an orchestration portal stitched to a batch record, a LIMS and a QMS with interfaces and email, and each join is a place where identity can be re-keyed and time can be lost. Seal holds the treatment order, the patient lot, its samples, its exceptions and its release decision as records of one case, so the status the centre sees is derived from the same evidence QA reviews. As the process matures, later lots pick up each approved revision, and each patient lot keeps the process version it was made under.

1Make the therapy case the control object.

A treatment order creates the governed case: product, treatment centre, planned dates, collection requirements, chain-of-identity token, permitted patient attributes, responsible roles and current state. Scheduling resolves the collection slot, courier lane, suite, equipment, qualified people, materials, laboratory capacity and release window around that case.

Treatment centres, coordinators, logistics, manufacturing, QC and QA each see a role-appropriate view of the same state. A schedule change keeps the prior plan, the reason, the approval and its effect on the remaining vein-to-vein window. The status shown outside manufacturing comes from operational evidence, not from a parallel tracker.

2Enforce identity and custody at every handoff.

Operational views use controlled pseudonymous identifiers. Authorised roles receive only the patient context their work requires, and access to protected identity, failed checks and changes is audited.¹

Chain of identity relates the patient, collection, starting material, every intermediate and sample, the final product, the shipment and the treatment-centre handoff.² Chain of custody records who held each physical object, where, when and in what condition. At every critical handoff the expected identifiers and the physical object are verified. A mismatch blocks normal progression and opens containment. Reprinting, relabelling and manual recovery keep the prior value and the reason for the change.

3Let manufacturing adapt inside approved boundaries.

Starting-material receipt is an eligibility gate. Identity, custody, collection time, container condition, quantity, cell count and documents determine whether processing can begin. Borderline material keeps its observed state and follows the approved decision path: continue, rescue, recollect or cancel.

The electronic batch record controls the process version, calculations, limits, timers, branches, signatures, materials, equipment and samples. Variable starting material may select an approved path; it does not permit improvisation. In the example below, a Day 7 viable-cell count below target extends culture to Day 10 under rule BR-CT-04. The executed branch keeps its source result, governing rule, decision authority and effect on the patient’s clock.

Equipment qualification, calibration, cleaning and availability gate the relevant step, and personnel need current procedural, aseptic and task qualification. If an eligibility later proves unacceptable, the same records identify every therapy case affected since the last known acceptable state.

Every material that touches the patient lot, from media, cytokines and vectors to bags, labels and cryopreservation materials, stays linked to it. Sampling, splitting, loss, cryogenic storage, pack-out and dispatch are explicit genealogy events, so a component concern traces forward to every affected case. Freezing profile, storage location, temperature evidence and excursions stay attached to the final product; restored temperature does not erase prior exposure.

4Land equipment data in the record it proves.

Connection design starts with the actual device: vendor, model, software, output, network location and the record it should populate. Cell washers, counters, incubators, bioreactors, cytometers, environmental monitors and controlled-rate freezers keep their native controls.

Swipe to see the full diagram →

Where the equipment supports it, Seal collects through an API, OPC UA, a file share, a serial gateway, a historian or a local edge service. The captured evidence keeps its source file or reference, checksum where applicable, instrument, method, operator, timestamp, units and its patient-lot, step or sample context. Each connection defines acknowledgement, retry, clock handling, completeness checks and a governed manual fallback. If a connection fails, the record shows the gap rather than silently substituting transcription.

5Share the case context with the laboratory and quality.

Manufacturing creates in-process and release samples with the source container, collection time, priority, test panel, limits and the decision waiting on them. Cell count, viability, identity, purity, potency-related measures, microbiology and vector copy results return to the step they govern. Environmental samples keep their room, session, activity, limits and the manufacturing window they affect.

A deviation opens from the exact patient lot, step, equipment, sample, result and time that triggered it. Investigation, OOS, CAPA, change control and disposition operate on the same objects as the batch record and the laboratory, so quality receives the context without an interface. Where another QMS remains authoritative, Seal sends the event context, keeps the external reference and uses the approved outcome to gate execution or release. Every retained system follows the same rule: one authority for each state, with versioned messages, acknowledgement, reconciliation and audit evidence.

6Assemble release as the case progresses.

Seal evaluates execution, identity and custody, genealogy, equipment and personnel eligibility, environmental evidence, laboratory results, quality events and outstanding actions as the patient lot progresses, rather than in a final document hunt. The CoA is generated from the approved specification and reviewed results. Disposition records what was reviewed, by whom, under which version and with which conditions and signatures.³ Pending evidence never appears as passed.

Final labels render from governed product, case and container data. Dispatch verifies the released state, destination, treatment schedule, shipper and documents; treatment-centre receipt records time, condition, identifiers and any discrepancy before the case reaches treatment readiness. Seal governs the operational handoff; clinical administration and medical judgement stay with the treatment centre.

When something goes wrong, whether an identity discrepancy, growth failure, missed process window, failed test, cryogenic excursion or courier delay, the event opens with the case, affected material, schedule, evidence and remaining window attached. Actions are time-stamped and acknowledged, and every party receives the governed status it needs without email becoming the operating model.

7Prove one representative case.

1. Define the case and authority. Configure the therapy case, identify any retained systems and give each state one authoritative owner.
2. Run the complete course. Execute order, scheduling, collection, logistics, receipt, batch record, samples, QC, environmental monitoring, quality, CoA, release, return and treatment readiness.
3. Connect the real equipment and systems. Test named interfaces, failure handling, security boundaries and manual fallback.
4. Validate and scale. Trace requirements to configuration and tests, train users by role, rehearse cutover and expand by process, suite or product.

Include the failure paths: an identity mismatch, a schedule change, a borderline receipt, a process branch, an equipment-data failure, an OOS result, a cryogenic excursion, a courier delay, a recollection and a cancellation. The system is ready when every path preserves identity, custody, evidence, time and an accountable decision.