Event tracking for advanced therapy medicinal products

There is provided a system for tracking events associated with a treatment by personalised medicine, the system comprising a plurality of nodes hosting a blockchain. The plurality of nodes include a plurality of sequence manager nodes, each associated with a respective sequence manager contract on the blockchain, and a hub node associated with a hub contract on the blockchain. A first sequence manager contract of the sequence manager contracts is arranged to receive first event data indicating a first event associated with the treatment, and store the first event data on the blockchain in association with a first event sequence. The hub contract is arranged to store an association between the first event sequence and one or more further event sequences associated with the treatment, on the blockchain.

BACKGROUND OF THE INVENTION

Field of the Invention

The present invention relates to tracking events associated with a type of medical treatment commonly referred to as personalised medicine or advanced therapy medicinal products (ATMP), for example cell and gene therapy (CGT).

Description of the Related Technology

Advanced therapy medicinal products, encompassing personalised medicine, precision medicine and theranostics, involves tailoring of medical treatments (for example decisions, practices, interventions and/or products) to an individual patient based on the patient's predicted response to the treatment and/or the patient's predicted risk of disease. In personalised medicine, diagnostic testing is employed for selecting an optimal treatment based on a patient's genetic makeup and/or other molecular or cellular analysis. Cell and gene therapy (CGT) is a specific type of personalised medicine in which immune cells are harvested from a patient and reprogrammed to target cancer in the same patient. CGT has been found to be effective for treatment of B-cell acute lymphoblastic leukaemia, diffuse large B-cell lymphoma, and primary mediastinal B-cell lymphoma, even in cases of advanced tumours and where other treatment options have been unsuccessful.

Personalised medicine, and CGT more specifically, is highly complex, and a single treatment generally requires multiple treatment stages to be performed in sequence, usually by multiple parties. CGT, in particular, is also time-critical, such that particular stages of the treatment must be performed within specified time limits, otherwise the entire treatment sequence must be restarted. Furthermore, certain materials involved in the treatment must be kept strictly within specified temperature ranges, otherwise the entire treatment sequence must be restarted. Due to the high cost of the treatment and limited availability of resources, in some cases restarting the sequence may be impracticable, resulting in grievous consequences for a patient. Furthermore, for patients diagnosed with advanced cancers, survival may depend on the treatment being successful on the first attempt.

The above considerations necessitate a reliable system for tracking materials and processes at the various stages of a treatment by personalised medicine. The system must be absent of any single point of failure, for example caused by human error by one of the parties involved in the treatment sequence, or by failure of one or more computer systems operated by the parties.

SUMMARY

According to a first aspect of the present invention, there is provided a system for tracking events associated with a treatment by personalised medicine, the system comprising a plurality of nodes hosting a blockchain. The plurality of nodes include a plurality of sequence manager nodes, each associated with a respective sequence manager contract on the blockchain, and a hub node associated with a hub contract on the blockchain. A first sequence manager contract of the sequence manager contracts is arranged to receive first event data indicating a first event associated with the treatment, and store the first event data on the blockchain in association with a first event sequence. The hub contract is arranged to store an association between the first event sequence and one or more further event sequences associated with the treatment, on the blockchain.

According to a second aspect of the invention, there is provided a method of tracking events associated with a treatment by personalised medicine using a blockchain hosted by a plurality of sequence manager nodes each having an associated sequence manager contract on the blockchain, and a hub node having an associated hub contract on the blockchain. The method includes: receiving, by a first sequence manager contract of the sequence manager contracts, first event data indicating a first event associated with the treatment; storing, by the first sequence manager contract, the first event data on the blockchain in association with a first event sequence; and storing, by the hub contract, an association between the first event sequence and one or more further event sequences associated with the treatment, on the blockchain.

DETAILED DESCRIPTION

FIG. 1shows an example of a system100for tracking events associated with a treatment by cell and gene therapy. The system includes multiple sequence manager nodes102a-f, referred to hereafter as sequence manager nodes102, and a hub node104. In this example, the sequence manager nodes102and the hub node104are physical servers. In other examples, sequence manager nodes and/or a hub node may instead be implemented as network-hosted web servers. The sequence manager nodes102and the hub node104are operated by different entities involved in the administration of the treatment by cell and gene therapy. The entity operating the hub node104is responsible for co-ordinating the tracking of the entire treatment, and entities operating the sequence manager nodes102perform specific tasks related to the treatment. As the various stages of the treatment progress, custody associated with the treatment (for example, custody of physical materials associated with the treatment) and the responsibility of tracking the treatment is passed between the entities, as will be described in more detail hereafter with reference to a specific example.

The sequence manager nodes102and the hub node104are connected to a network106, and record data associated with events during the treatment as transactions on a permissioned blockchain108. The permissioned blockchain108has associated state storage109that stores a current state of the blockchain108, including any smart contracts uploaded to the blockchain108and smart contract storage associated with those smart contracts. In this example, the permissioned blockchain108is based on Quorum, which is a blockchain and smart contract platform based on Ethereum. Quorum includes functionality to support private smart contracts and private transactions. Data stored in association with private smart contracts and private transactions is only accessible to specified nodes in a network. Quorum smart contracts are generally written in high-level programming languages such as Solidity, Serpent, or Lisp Like Language (LLL), and specify rules that govern transactions between accounts with addresses on the blockchain108, as well as messages transmitted between the smart contracts themselves. Quorum is Turing complete, meaning that that in principle, Quorum smart contracts may be programmed to perform any reasonable computing task, provided that sufficient computing resources (for example, memory) are available.

When a smart contract is uploaded to the permissioned blockchain108, the smart contract code is compiled into virtual machine code, which is executed by nodes that download and verify blocks that form the permissioned blockchain108. The execution of the virtual machine code generally results in a change in the state of the permissioned blockchain108. Multiple nodes (in this example, the sequence manager nodes102and the hub node104) execute the same virtual machine code associated with a given block, and consensus between the downloaded blocks is ensured using a consensus algorithm such as Raft or Istanbul BFT. Consensus between the nodes builds redundancy into the system such that there is no single point of failure within the tracking system100.

Using a permissioned blockchain allows for a significantly higher transaction throughput than the alternative option of using public blockchain such as the Ethereum main chain. The blockchain108only needs to store transactions and smart contracts related to the tracking system100. By contrast, the Ethereum main chain includes transactions and smart contracts relating to a large number of entities, many of which are completely unrelated. Furthermore, data stored on the permissioned blockchain108is only accessible to the nodes hosting the permissioned blockchain108(i.e. the sequence manager nodes102and the hub node104), resulting in improved data security compared with that of a public blockchain. Nevertheless, a public blockchain could be used in place of the permissioned blockchain108.

The sequence manager nodes102and the hub node104each have an associated blockchain account with an address on the permissioned blockchain108. An address of a blockchain account is derived from a cryptographic public key associated with the account, which in turn is derived from a cryptographic private key associated with the account. Transactions sent from a given account are signed by the associated private key, allowing a recipient of the transaction (which, generally, may be another account or a smart contract) to verify that the transaction was actually sent by that account.

Each of the sequence manager nodes102x(where x is one of a-f) is associated with a respective sequence manager contract110xon the permissioned blockchain108. The sequence manager contracts110xare instances of the same smart contract, and are referred to collectively as sequence manager contracts110. Each sequence manager contract110xstores a record of the blockchain address of the associated sequence manager node102x, and is only able to accept transactions from that sequence manager node102x, as opposed to another sequence manager node102y(where y is not the same as x) or the hub node104. The hub node104is associated with a hub contract112on the permissioned blockchain108. The hub contract112stores a record of the blockchain address associated with the hub node104, and is only able to accept transactions from the hub node104(as opposed to the sequence manager nodes102).

Each sequence manager contract110xhas an address on the permissioned blockchain108and includes smart contract code and associated storage for storing event data on the permissioned blockchain108. The sequence manager contract110xis arranged to receive the event data from the associated sequence manager node102x, where the event data indicates events associated with the treatment by cell and gene therapy and performed by the entity operating the associated sequence manager node102x. The sequence manager contract110xis, by default, private to the sequence manager node102xand the hub node104, such that data stored on the permissioned blockchain108by the sequence manager contract110xis encrypted and cannot be viewed by other sequence manager nodes102y. In some cases, a sequence manager contract110xmay be configured to allow one or more additional sequence manager nodes102yto view data stored by the sequence manager contract110x. Privacy of data relating to the treatment by cell and gene therapy is an essential requirement of the system100. By ensuring that each party associated with the treatment may only interact with an associated sequence manager contract, data privacy between parties is ensured.

The content of the event data indicating a given event depends on an event type of the event. The sequence manager contract110xis arranged to perform a number of processing operations in response to receiving event data from the associated sequence manager node102x, such that the storing of the event data on the permissioned blockchain108is dependent on the outcome of these processing operations. The specific processing operations for storing a given event depend on the event type, as will be described in more detail hereafter. The sequence manager contract110xstores the event data indicating a given event in association with an event sequence. An event sequence includes event data indicating events relating to a single treatment, and received from the same sequence manager node102x. In the present example, the event data in a given event sequence indicates events performed by the entity operating the corresponding sequence manager node102x.

The hub contract112has an address on the permissioned blockchain108and includes smart contract code and associated storage for storing, on the permissioned blockchain108, associations between event sequences relating to a single treatment. More precisely, the hub contract112is arranged to store multiple segment groups, each relating to a respective treatment. Each segment group includes data indicating one or more event sequences stored by one or more respective sequence manager contracts110. In this way, the hub contract112links together events relating to a single treatment but performed by multiple entities.

As shown inFIG. 2, a sequence manager contract110xhas associated sequence manager contract storage114. In the present example, the sequence manager contract storage114is on-chain, meaning that it forms part of a global state of the permissioned blockchain104, and is stored by every node that downloads and verifies an associated block in the permissioned blockchain104. In other examples, sequence manager storage may be off-chain, meaning that it is stored independently from the permissioned blockchain108. In either case, the sequence manager contract storage114is arranged such that verification of blocks of the permissioned blockchain108ensures immutability of data stored in the sequence manager contract storage114. The sequence manager contract110xcan read data from the sequence manager contract storage114and can write data to the sequence manager contract storage114. The sequence manager contract110xstores a record of the blockchain address116of the account associated with the corresponding sequence manager node102x. The sequence manager contract110xonly accepts transactions from the specified address116, so only the entity that operates that sequence manager node102xis able to upload event data to the blockchain108via the sequence manager contract110x. The sequence manager contract110xalso includes the blockchain address118of the hub contract112. As will be explained in more detail hereafter, the sequence manager contract110xexchanges messages with the hub contract112for various reasons, including for linking event sequences together in a segment group.

The sequence manager contract110xincludes unlinked event validation code120. This code is executed in response to the corresponding sequence manager node102xsending event data via a transaction to the sequence manager contract110x. The unlinked event validation code120validates received event data without reference to any other events in an event sequence. In the present example, the unlinked event validation includes determining that predetermined mandatory data fields are completed within the received event data. For any type of event, the predetermined mandatory data fields include a treatment identifier that is unique to an individual treatment, and an event type. Further mandatory data fields depend on the event type, and will be described in more detail hereafter with reference to a specific example. If the event data fails to satisfy the unlinked event validation, the sequence manager contract110xwill not store the event data on the permissioned blockchain108.

The sequence manager contract110xalso includes event linking code122. The sequence manager contract110xexecutes the event linking code122when event data is successfully validated using the unlinked event validation code120. If the event corresponds to a receiving of custody by the party operating the associated sequence manager node102x(for example, in the case of a receipt of physical materials associated with a treatment), the event linking code122generates a new sequence in the sequence manager contract storage114. The new sequence is allocated a new unique sequence identifier. For any event that does not correspond to a receiving of custody, the event linking code122searches the sequence manager contract storage114for an event sequence stored on the permissioned blockchain108with the same treatment identifier. If an event sequence with the same treatment identifier is located, the event linking code122adds the event data to the located event sequence. If the event linking fails, for example because an expected event sequence is not located, the sequence manager contract110xwill not store the event data on the permissioned blockchain108.

The sequence manager contract110xincludes aggregation code124. The aggregation code124is executed when the event type indicates a commissioning of physical materials, a receipt of physical materials, or a packing of physical materials. When the event type indicates a commissioning or receipt of physical materials, the aggregation code124stores, in association with the new event sequence generated by the event linking code122, a new aggregation identifier. When the event type indicates a packing of physical materials, the aggregation code124retrieves an aggregation identifier from the existing event sequence to which the event is added, and stores aggregation data indicating that the physical materials are packed within a container. The physical materials and the container each have an identifier, and the aggregation data stores these identifiers hierarchically to indicate the packing of the physical materials within the container. At a later time, the container may be packed within a further container, in which case the aggregation code124adds an identifier of the further container to the hierarchical aggregation data. Alternatively, the physical materials may be unpacked from the container, in which case the aggregation code124removes the association between the identifiers of the physical materials and the container. The sequence manager contract110xuses the aggregation data to check for consistency between events added to an event sequence, as will be described in more detail hereafter.

As shown inFIG. 3, the sequence manager contract storage114is arranged to hold multiple event sequences. Each event sequence is allocated a sequence identifier, and is associated with a single treatment having a treatment identifier as mentioned above. The event sequence includes event data indicating events associated with that treatment, and performed by the operator of the associated sequence manager node102. Each event sequence also includes hierarchical aggregation data indicative of any packing of physical materials associated with the treatment.

FIG. 4shows an example of a data structure indicating an event. The data structure includes a treatment identifier to indicate which treatment the event relates to, and a patient identifier unique to the patient receiving the treatment. The treatment identifier is used by the sequence manager contract110xto link the event to an event sequence, and is further used by the hub contract112to link event sequences together to form a segment group. The patient identifier is used instead of a name or any other personal information to ensure that data stored on the permissioned blockchain108is anonymous, and that parties performing various actions in respect of the treatment are not able to identify the patient to whom the treatment is administered. As will be described in more detail hereafter, only the party that enrolls the treatment (which, in this example is an oncologist) has a record of the association between the patient identifier and the identity of the patient. In this way, the privacy of the patient is protected.

The event data includes a timestamp indicating a time at which the event occurred, and location data indicating a location at which the event occurred (for example, longitudinal and latitudinal co-ordinates). In the present example, the timestamp and the location data are automatically determined when the event occurs, as will be described in more detail with reference to specific type of event. The event data also includes an event type, and additional event data that depends on the event type. As explained above, event data will only be successfully stored on the permissioned blockchain108if the event data includes mandatory event data in accordance with the event type.

Returning toFIG. 2, the sequence manager contract110xincludes linked event validation code126. The sequence manager contract110xexecutes the linked event validation code126after the event linking code122(and, if the aggregation code124is executed, after the aggregation code124). In the present example, the linked event validation code126ensures that the event data is consistent with the events previously uploaded to the event sequence (i.e. in the correct order). If the event data fails to satisfy the linked event validation, the sequence manager contract110xwill not store the event data on the permissioned blockchain108. If the event data indicates a receiving of custody, the event validation code126causes messages to be exchanged with the hub contract112to determine whether authorisation has been given to the sequence manager contract110xto upload the event data, as will be described in more detail hereafter.

The sequence manager contract110xincludes event conditional code128. The event conditional code128depends on the event type of the uploaded event data, and includes conditions that must be satisfied for the event to be successfully added to the event sequence. Examples of conditions associated with specific events will be described in more detail hereafter.

The sequence manager contract110xincludes alarm code130. The alarm code130is executed if any of the conditions specified in the event conditional code128are not satisfied. The alarm code130causes the sequence manager contract110xto emit an alarm event on the permissioned blockchain108, and further to send a message to the hub contract112, causing the hub contract112to emit an alarm event on the permissioned blockchain108. As will be described in more detail hereafter, the sequence manager node102xassociated with the sequence manager contract110xis arranged to listen for alarm events emitted by the sequence manager contract110x, such that a user of the sequence manager node102xcan be alerted immediately if a condition specified by the event conditional code128is not satisfied. Similarly, the hub node104is arranged to listen for alarm events emitted by the hub contract112, so that a user of the hub node104can be alerted immediately if a condition specified by the event conditional code is128not satisfied.

As shown inFIG. 5, the hub contract112has associated hub contract storage132on the permissioned blockchain108. In the present example, the hub contract storage132is on-chain. In other examples, hub contract storage may be off-chain. In either case, the hub contract storage132is arranged such that verification of blocks of the permissioned blockchain108ensures immutability of data stored in the hub contract storage132. The hub contract112can read data from the hub contract storage132and can write data to the hub contract storage132. The hub contract112stores a record of the blockchain addresses134of the sequence manager contracts110. The hub contract114exchanges messages with the sequence manager contracts110to grant or deny permission for certain event data to be stored on the permissioned blockchain108, and to link event sequences together in a segment group.

The hub contract112includes permission checking code136, which is executed in response to the hub contract112receiving a message from a sequence manager contract110xindicating a receiving of custody by an operator of the associated sequence manager node102x. The message constitutes a request for permission to store corresponding event data on the permissioned blockchain108. The message includes a sequence identifier generated by the sequence manager contract110xas described above, and a treatment identifier for the treatment. The permission checking code136is arranged to determine that the sequence manager contract110xis permitted to store the event data on the permissioned blockchain108. In the present example, the permission checking code determines whether the sequence manager contract110xis permitted to store the event data by querying a further sequence manager contract110yfor event data indicating that the sequence manager contract110xis permitted to store the event data (and accordingly, indicating that the operator of the sequence manager node102yintends to transfer custody to the operator of the sequence manager node102x).

The hub contract112includes segment linking code138, which is executed in response to the permission checking code136determining that the sequence manager contract110xis permitted to store event data on the permissioned blockchain108. The segment linking code138searches the hub contract storage114for a segment group with the same treatment identifier as the event data to be stored. If a segment group with the same treatment identifier is located, the segment linking code138adds the sequence to the located segment group.

As shown inFIG. 6, the hub contract storage132is arranged to hold multiple segment groups. Each segment group is allocated a segment group identifier, and is associated with a single treatment having a treatment identifier as mentioned above. The segment group includes data indicative of the sequences relating to that treatment, including the sequence identifier for each sequence, and data indicative of the sequence manager contract110xresponsible for the sequence (for example, the address of the sequence manager contract110xon the permissioned blockchain108.

Returning toFIG. 5, the hub contract112includes sequence querying code140. The sequence querying code140is executed in response to the hub contract112receiving a query from the hub node104regarding event data within sequences in a given segment group. The sequence querying code140is also executed in response to the hub contract112receiving a message from one of the sequence manager contracts110requesting permission relating to a receipt of custody associated with a treatment. The sequence querying code140causes the hub contract112to send a message to a sequence manager contract110xto request event data stored by that sequence manager contract110x.

The hub contract112includes alarm code142. The alarm code142is executed in response to the hub contract112receiving an alarm message from one of the sequence manager contracts110indicating that one or more event conditions is not satisfied. The alarm code142causes the hub contract112to emit an alarm event on the permissioned blockchain108. The hub node104is arranged to listen for alarm events emitted by the hub contract112, so that a user of the hub node104can be alerted immediately when the one or more event conditions is not satisfied.

As shown inFIG. 7, a sequence manager node102xincludes a power supply146and a system bus148. The system bus148is connected to: a CPU150; input/output devices152; a communication module154; and memory156. The input/output devices152allow a user to interact with the sequence manager node102x, and include, for example, a keyboard, a monitor, and a mouse/trackpad. The memory156includes non-volatile storage and volatile memory, and holds: user interface code158; event receiving code160; blockchain application programming interface (API) code162; and cryptographic keys164.

The event receiving code156is executed when new event data is uploaded to the sequence manager node102x. For some events, event data is input manually by a user via a user interface of the sequence manager node102x. For other events, event data is generated automatically and/or received via the communication module154. One example in which event data is generated automatically uploaded is where the event data corresponds to a measurement by an automatic temperature sensor of a temperature of physical materials associated with the treatment, in which case the automatic temperature sensor is arranged to transmit the measured temperature to the sequence manager node, along with further mandatory data such as the time and location of the temperature measurement. Another example in which event data is generated automatically uploaded is where physical materials are scanned using a scanning device (for example, a Quick Response (QR) code scanning device or a Near Field Communication (NFC) device) to determine an identifier associated with the physical materials.

The blockchain API code162allows the sequence manager node102xto interact with the permissioned blockchain108. The blockchain API code162makes is arranged to send transactions to the sequence manager contract110x, and to query the sequence manager contract110xfor data on request of a user. In the present example, the blockchain API code162is also arranged to listen for alarm events emitted by the sequence manager contract110, where the alarm events may indicate that conditions specified within the event conditional code128have not been satisfied by a given event submitted to the sequence manager contract110x.

The cryptographic keys164include a public key and private key associated with the account of the sequence manager node102xon the permissioned blockchain108. The sequence manager node102xuses this private key to sign transactions, such as the uploading of event data to the sequence manager contract110xon the permissioned blockchain108. The cryptographic keys164also include public and private keys for implementing the privacy of the sequence manager contract110x(as mentioned earlier, the sequence manager contract110xis private to the sequence manager node102xand the hub node108). In an alternative implementation, private and public keys associated with an account may also be used for implementing privacy of a contract.

As shown inFIG. 8, the hub node104includes a power supply166and a system bus168. The system bus168is connected to: a CPU170; input/output devices172; and a memory174. The input/output devices172allow a user to interact with the hub node104, and include, for example, a keyboard, a monitor, and a mouse/trackpad. The memory174holds: user interface code176; blockchain API code178; and cryptographic keys180.

The blockchain API code178allows the hub node104to interact with the permissioned blockchain108. The blockchain API code178is arranged to hub contract112for data on request of a user. In the present example, the blockchain API code178is also arranged to listen for alarm events emitted by the hub contract112.

The cryptographic keys180include a public key and private key associated with the account of the hub node102xon the permissioned blockchain108. The cryptographic keys164also include public and private keys for implementing the privacy of the hub contract112and the sequence manager contracts110(the hub contract112is private to the hub node104, and the hub node104may also access data stored by the sequence manager contracts110).

FIG. 9shows an example in which a sequence manager node102xreceives event data indicating an event associated with a treatment by cell and gene therapy. In this example, the event does not relate to a receiving of custody from a different entity. The sequence manager node102xreceives the event data at S902, either as a result of a user entering the event data via a user interface of the sequence manager node102x, or via a signal from a sensor device or scanning device. The sequence manager node102xtransmits, at S904, the event data to the sequence manager contract110xvia a blockchain API.

The sequence manager contract110xreceives the event data at S906, and performs unlinked event validation at S908. The unlinked event validation includes ensuring that the event data includes predetermined mandatory data. The predetermined mandatory data includes a patient identifier, a treatment identifier, and an event type. Further mandatory data depends on the event type. If the unlinked event validation is unsuccessful, the sequence manager contract110xdoes not store the event data on the permissioned blockchain108.

If the unlinked event validation is successful, the sequence manager contract110xlinks the event data at S910. In this example, the event type does not indicate a receiving of custody, and therefore to link the event data the sequence manager contract110xsearches the associated sequence manager contract storage114for a sequence identifier stored in association with the same treatment identifier as that of the event data to be linked. If no such sequence identifier is located, the event data will not be stored on the permissioned blockchain108. If a sequence identifier is located, the sequence manager contract110xadds the event data to the located event sequence.

If the event linking is successful, the sequence manager contract110xperforms linked event validation at S912. The linked event validation includes ensuring that the event type of the event data to be uploaded is consistent with the events previously uploaded to the event sequence if the linked event validation is successful, the sequence manager contract110xdoes not store the event data on the permissioned blockchain108.

If the linked event validation is successful, the sequence manager contract110xdetermines, at S914, whether the event data satisfies event conditions depending on the event type of the event data to be stored. If any of the event conditions are not satisfied, the sequence manager contract110xemits an alarm event on the permissioned blockchain108, and sends an alarm message to the hub contract104. In this way, the operator of the sequence manager node102xand the operator of the hub node104are immediately notified that there is a problem. The sequence manager contract110astores the event data at S916.

FIG. 10shows an example in which linked event validation is performed for event data relating to a receiving of custody from a different entity. The first sequence manager110xsends, at S1002, a message to the hub contract112to request permission from the hub contract112to store the event data. The message includes the treatment identifier of the treatment to which the event data relates. Upon receiving the message, the hub contract112determines, at S1004, an address of a second sequence manager contract110yon the permissioned blockchain108. In the present example, the hub contract112determines the address of the second sequence manager contract110yby searching the hub contract storage132for a segment group associated with the same treatment identifier as the event data to be stored, and determining the sequence manager contract110xresponsible for the most recent sequence in the segment group. In other examples, a hub contract may determine the address of the second sequence manager contract110yin dependence on the address of first sequence manager contract110x.

Having determined the address of the second sequence manager contract110y, the hub contract112queries, at S1006, the second sequence manager contract110yfor event data indicating a passing of custody associated with the treatment, and indicating that the operator of the first sequence manager contract110xis an intended recipient of the custody. The second sequence manager contract110ysends, at S1008, a response to the query from the hub contract112, indicating whether event data stored by the second sequence manager contract110yindicates a passing of custody associated with the treatment, and that operator of the first sequence manager node102xis an intended recipient of the custody (for example, by specifying, in an intended recipient field, an identifier associated with the operator of the first sequence manager node102x, or the blockchain address of the first sequence manager contract110x).

The hub contract112determines, at S1010, whether the first sequence manager contract110xis permitted to store the event data indicating the receiving of custody. The first sequence manager contract110xis permitted to store the event data if the second sequence manager contract110ystores event data indicating the first sequence manager contract110xas an intended recipient of a passing of custody. In other examples, a second sequence manager contract may determine whether a first sequence manager contract is permitted to store event data, in which case the second sequence manager contract sends the outcome of the determination to the hub contract112. If the hub contract112determines that the first sequence manager contract110xis not permitted to store the event data, the hub contract emits an alarm event on the permissioned blockchain108, so that the entity overseeing the treatment is made aware that an error may have occurred.

The hub contract112sends, at S1012, a message to the first sequence manager contract110xindicating the outcome of the determination. If the message indicates that the first sequence manager contract110xis not permitted to store the event data, the first sequence manager contract110xdoes not store the event data on the permissioned blockchain108. If the message indicates that the first sequence manager contract110xis permitted to store the event data, the first sequence manager contract110xtransmits, at S1014, sequence data to the hub contract112. In the present example, the sequence data includes a sequence identifier associated with the sequence in which the event data will be stored. The first sequence manager contract generates the sequence identifier is generated during an event linking process, as described above. The hub contract112adds, at S1016, the sequence in which the event data will be stored to the segment group corresponding to the treatment.

FIG. 11shows an example of a sequence of events associated with a CGT treatment. The events are uploaded to the sequence manager nodes102a-fand relate to tasks performed by the entities operating the sequence manager nodes. The dashed arrows inFIG. 11represent transfers of custody between the entities. Details of the events are given below:

Treatment Enrolment—Performed at an Oncologist Surgery

S1101: Select and Request TreatmentIncludes generating a unique treatment identifier and a patient identifier.

S1102: Patient RegistrationMandatory event data includes a hash of a completed patient registration form.

S1103: Scheduling of AppointmentsMandatory data includes a schedule date and a clinic identifier for treatment centre.Includes passing custody to a treatment centre.

Tissue Harvesting—Performed at a Treatment Centre

S1104: Regulatory Form AttestationMandatory event data includes a hash of a completed regulatory form.Includes checking for permission to receive custody.

S1105: Selection Kit CommissioningMandatory data includes a selection kit identifier.Includes generating a new aggregation identifier.

S1106: Collection Kit InspectionEvent conditions include pass/fail of inspection.

S1107: Cell-Tissue HarvestingEvent data is rejected if collection kit inspection failed.

S1108: Cryo-PreserveMandatory data includes starting temperature and ending temperature.Event conditions include starting temperature and ending temperature being within respective predetermined ranges, and time since last step being within a predetermined range.Includes time excursion check.

Logistics—Performed by a Logistics Company

S1111: Pick UpIncludes checking for permission to receive custody, temperature excursion check, time excursion check.

S1113: Transport and Customs ClearanceIncludes temperature excursion check, time excursion check.Event conditions include pass/fail of clearance.

Tissue Processing (CGT Activation)—Performed by a Pharmaceutical Company

S1115: Cell/Tissue Product ReceivingIncludes checking for permission to receive custody, temperature excursion check, time excursion check.

S1121: Quality AssuranceIncludes temperature excursion check, time excursion check.Event conditions include pass/fail of quality test.

S1122: Cryo Preservation.Event data is rejected if collection kit inspection failed.Mandatory data includes starting temperature and ending temperature.Event conditions include starting temperature and ending temperature being within respective predetermined ranges, and time since last step being within a predetermined range.

Logistics—Performed by a Logistics Company

S1126: Pick UpIncludes checking for permission to receive custody, temperature excursion check, time excursion check.

S1128: Transport and Customs ClearanceIncludes temperature excursion check, time excursion check.Event conditions include pass/fail of clearance.

S1129: DeliveryIncludes temperature excursion check, time excursion check, passing custody to treatment centre.

Administer Treatment—Performed at a Treatment Centre

S1130: Cell/Tissue Product ReceivingIncludes checking for permission to receive custody, temperature excursion check, time excursion check.

S1133: Administration to Patient

Treatment Follow-Up—Performed at Treatment Follow-Up Centre

S1135: Check-UpIncludes checking for permission to receive custody

S1136: Update to Pharmaceutical Company

A time excursion check involves determining a difference between a timestamp associated with an event and a timestamp associated with an earlier event. Depending on the event type, the earlier event may be the most recent event, or may be a predetermined earlier event. In some cases, the earlier event is stored by the same sequence manager contract110xas the later event. In other cases, the earlier event is stored by a different sequence manager contract110y. If the earlier event is stored by a different sequence manager contract110y, the sequence manager contract queries the hub contract112, which queries the sequence manager contract110yfor the earlier timestamp. The sequence manager contract110xreceiving the later event data is arranged to emit an alarm event on the permissioned blockchain108, and to transmit an alarm message to the hub contract, when the difference between the timestamps exceeds a threshold duration of time.

A temperature excursion check involves a temperature sensor (for example, an automatic temperature sensor) measuring a temperature of physical materials (for example, a cell/tissue product) and transmitting the measured temperature to the sequence manager node associated102xas part of the event data to be uploaded. The sequence manager contract110xis arranged to emit an alarm event on the permissioned blockchain108, and to transmit an alarm message to the hub contract112, when the measured temperature lies outside a predetermined range.

In the scheduling of appointments at step S1103, the sequence manager node associated with the oncologist surgery or the like may use an API to access scheduling information from the pharmaceutical company. In this way, the oncologist surgery can reserve time at the pharmaceutical company for various operations involved in the treatment processing.

As mentioned above, physical materials may be associated with a unique QR code that is scanned each time there is a handover in the change of custody. This QR code will store the unique patient identifier.

During tissue harvesting, a unique Sample_QR code is generated and a printable label including the unique Sample_QR code is generated and printed copies pf the Sample_QR code are attached to packaging associated with the harvested tissue. For example, a printed Sample_QR code may be attached to a test tube holding the harvested tissue and also on the outside of a delivery box. If a replacement tissue sample is needed, then a new Sample_QR code is issued. To highlight that this is a different sample, a visible indication may be included on the printed QR label. For example, the numbering “02” may be added.

During tissue processing, a Treatment_QR code is generated and printed copies of the Treatment_QR code are attached to packaging associated with the treatment product. Again, a printed Treatment_QR code may be attached to a test tube holding the treatment product and also on the outside of a delivery box.

Finally, to assist in tracking the chain of custody, a unique Person_QR code is associated with each person in the chain of custody, for example for a nurse at the at an oncologist surgery, a courier working for a courier firm and a lab technician working at the pharmaceutical company. These QR codes are printed and scanned during the change of custody. For example, a courier picking up a tissue sample scans both the Sample_QR code for the sample and the Person_QR code for the nurse handing over the sample, while that nurse scans the Sample_QR code for the sample and the Person_QR code for the courier. Similar operations occur each time that the tissue sample changes custody and the treatment product changes custody.

Given that there are three different types of QR code, in an example each type of QR code is printed in a given colour to avoid confusion. For example, a Sample_QR code may be printed in blue, a Treatment_QR code may be printed in Green and a Person_QR code may be printed in Black.

Example embodiments may make use of mobile applications on smartphones, tablets and the like to assist with the collation of event data. For example, the mobile application may control the scanning of QR codes during a change of custody. It will be appreciated that the mobile applications may be customised for the role of the stakeholder so that, for example, the mobile application for a courier only handles events associated with the courier.

While using QR codes is convenient, ti will be appreciated that other tagging technologies could be used such as RFID codes, NFC chips or Internet of Things (IoT) devices.

The above embodiments are to be understood as illustrative examples of the invention. Further embodiments of the invention are envisaged. For example, a system in accordance with the present invention may be used to track events relating to a different type of therapy, for example a homologous or allogenic cell and gene therapy, stem cell therapy or another form of treatment by personalised medicine. Similarly, in other embodiments the invention can be applied to blood and organ transplant. In some examples, one of the entities involved in certain stages of administering the treatment may also be responsible for overseeing the treatment (for example, an entity that enrolls a patient for the treatment). In this case, a hub node may be combined with a sequence manager node, and/or a hub contract may be combined with a sequence manager contract. In some examples, data stored on a permissioned blockchain may be anchored onto a public blockchain, such as the Ethereum main chain, for improved security.

Although the illustrated embodiments utilise Quorum, it will be appreciated that the invention is blockchain agnostic and other blockchain platforms could be used, for example the R3 Cardano, IBM Hyperledger or Oracle blockchain platforms. While there are advantages to using a permissioned blockchain as discussed above, the invention could be implemented on a public blockchain.