Scan a QR code. Know the medicine is real — and where it has been.

Pharmaceutical products rarely move directly from the manufacturer to the person who uses them. There are handoffs: manufacturer → provider → shop → customer.

At Virtual Tech Gurus, those steps lived in different places — paperwork here, spreadsheets there, systems that weren't really talking to each other. When someone wanted to know whether a particular package was legitimate, there was no reliable record behind the answer. Just a document to find later, or a spreadsheet that may or may not have been updated.

The brief was simple to explain — and much harder to build properly:

Put a QR code on a medicine package, let someone scan it with their phone, and show them whether that product is genuine and where it has been.

That meant solving two problems at once: make verification extremely simple for the customer, while making the underlying supply chain considerably stricter.

It's a challenge that sits exactly where healthcare software development meets logistics & transportation software development — regulated workflows on one side, custody moving between organisations on the other.

The platform covers the full chain: Company → Provider → Shop → User. Each business stage has its own role-based interface and permissions; the customer-facing verification experience is deliberately different — it's public.

01 — Manufacture

The pharmaceutical company registers a drug type and creates individual medicine units under an active licence. Each unit receives a unique traceable ID, mapped to its QR code at creation. The rule is enforced at the API level — not in the interface:

POST /api/v1/medicine-units
→ 422 Unprocessable Entity

{
  "error": "LICENCE_REQUIRED",
  "message": "A medicine unit cannot be created without an active licence for this drug type."
}

02 — Distribution

The provider receives stock through the company-side workflow. Ownership isn't updated later through a separate reconciliation process — the transfer is recorded when the provider accepts the stock. Every handoff writes an event:

{
  "unitId": "MED-2024-000123",
  "event": "OWNERSHIP_TRANSFER",
  "from": "acme-pharma",
  "to": "medsupply-co",
  "recordedAt": "2024-06-14T09:32:11Z"
}

That gives the system a clean answer to the most basic supply-chain question: who actually had this product, and when?

03 — Retail

The shop receives the product from the provider and dispenses it to the customer. The shop-side transaction closes the operational part of the chain and updates the unit's state — at this point the system holds a connected custody trail, not a collection of disconnected records.

04 — Customer verification

A customer scans the QR code printed on the package. The verification page returns the product's status and custody history — no account, no login, no app to install. The customer doesn't need to understand the architecture; they just need an answer: is this product what it says it is, and does its history make sense?

What happens when a scan doesn't check out

Verification is only useful if it also fails loudly. An unknown code returns an explicit not recognised result — never a blank screen. A unit whose history doesn't add up shows that status plainly. The failure states are where the anti-counterfeit value lives, so they're treated as first-class outcomes, not error pages.

Key architectural decisions

• One traceable record per medicine unit — the QR code points to it; the record tells the story.
• Licence-gated creation — enforced at the API, not the interface.
• Forward-only ownership transfers — recorded at acceptance, never sideways or backwards.
• Separated public verification endpoint — rate-limited, minimal data exposure.
• PostgreSQL as the single source of truth — every handoff writes an audit event.

It's tempting to think the QR code is the product. It isn't — the QR code is the doorway. The hard part is everything that has to be true after someone scans: a reliable record of the unit, who created it, who received it, who holds it now, no invalid ownership movements — and enough exposed to be useful without leaking internal identifiers. Four layers deliver that:

Role-based access

Company and provider users operate through role-based panels, creating, receiving and transferring stock according to the permissions assigned to their stage. Every important action is tied to an audit record.

Server-side business rules

The REST API doesn't leave critical rules to the frontend. Ownership can move forward through the defined chain — never sideways or backwards. A button being hidden in React is not a security rule. The backend has to enforce it too.

A single source of truth

A relational PostgreSQL layer maintains the traceable record for each individual unit — a digital identity that follows every package through the supply chain.

A public verification layer

The customer-facing endpoint is intentionally separated from the internal management environment. It's rate-limited and returns only the information needed for verification. Simple from the outside; controlled underneath.

Pharmaceutical traceability doesn't exist in a regulatory vacuum. In the US, the DSCSA requires unit-level serialization and interoperable electronic tracing of prescription drugs. In the EU, the Falsified Medicines Directive mandates a unique identifier on each pack, verified at the point of dispensing. Underneath both sits the GS1 serialization model — a unique identity per saleable unit, plus batch and expiry — which has become the industry's common language.

The platform's design — unit-level identifiers, event-recorded custody changes at every handoff, licence-gated creation — is the same pattern those regulations are built around. Market-specific requirements layer on top of this foundation rather than requiring a rebuild.

Because traceability isn't just knowing where something is — it's establishing a trustworthy history:

• Who created it?
• Who received it?
• Who transferred it?
• Who currently holds it?
• Was that movement allowed?
• Can the customer verify the product without access to the internal system?

These questions get harder when a product passes through multiple organisations. The same pattern extends well beyond pharmaceuticals: give every unit an identity, enforce the rules at every handoff, and make the history available to the people who need it. That's the core of any multi-stage logistics platform — and where existing enterprise systems are involved, ERP integration services can bring them into the traceability flow instead of forcing a replacement.

The sequence was deliberate:

1. Backend and data model — the foundation had to be stable first.
2. Business rules and API — built around the actual supply-chain workflow, not around the screens.
3. Role-based panels and the QR verification experience — once the chain underneath was solid.

Testing wasn't saved for the final few days; it was folded in as each part came together. That worked because the project was never four separate interfaces — it was one chain. If the manufacturing logic was wrong, the provider workflow would expose it. If the transfer logic was wrong, the customer's verification history would be wrong.

The stack was chosen for fit, not fashion: Node.js for the backend and API layer, React.js for the operational interfaces, and PostgreSQL as the relational source of truth for every traceable record.

When the workflow itself is the product and no off-the-shelf system fits, this is the territory of custom software development — the platform is shaped around the chain, not the other way round.

The numbers since launch:

The ~230ms response time matters in a slightly boring but very real way: someone points a phone at a package and expects an answer almost immediately. A verification page shouldn't feel like an old database lookup.

The quieter win was operational. Manual reconciliation between the company, provider and shop sides was largely reduced — the system records each handoff as it happens instead of relying on people to reconcile separate records afterward.

“Reconciliation between our company, provider and shop records used to be a manual chore. Now it happens the moment stock is accepted, and our customers can verify any package with a scan.” — Roman Harris, Operations Director, Virtual Tech Gurus Inc.

That's the kind of improvement that matters six months after launch, when the novelty has worn off and people are simply using the system every day.