Verofax Trace · National Medicines Traceability

Every medicine verified. Port to patient.

A national platform that gives each pack a digital identity, follows it through the chain, and confirms it is genuine at the counter — online or offline, in under a second.

Government‑owned, in‑countryGS1 · EPCIS 2.0 · HL7 FHIRProven at national scale
pharma.verofax.com — National overview
National overview screen of the traceability platform

Trusted by Fortune 100 companies and public bodies across 50 markets

Emirates Flight Catering NHC AB InBev Balady Ministry of Health, Zambia
The problem

Once a pack clears the port, no one can see it.

1 in 10

Falsified or substandard

WHO estimate for medical products in low‑ and middle‑income countries. Found by accident, after harm.

>90%

Imported, then invisible

Visibility ends at customs. Public facilities run short while the same products appear on private shelves.

2027

Diversion follows the gaps

As neighbours mandate unique identifiers, uncoded markets become the path of least resistance.

Two decisions that make or break a programme

Built on GS1. Designed for no signal.

QR code resolving to the pack verification page
(01) 06291041500213
(21) TZ7K2M9Q4A
(10) AMX‑2607
(17) 280331
GS1 identity

One global standard, so the country never pays for a proprietary one.

The code already required by the EU, US, Saudi Arabia, Egypt and India’s export market.

  • Most imports need no new packaging
  • Any vendor or system can connect via EPCIS 2.0
  • One serial = one auditable fee unit
  • Recalls and claims work at pack level
Offline‑first verification

The last scan happens where the network is weakest.

If verification needs a signal, dispensers stop scanning and the data stops. The field app is built for the facility, not the capital.

  • Encrypted local cache of product, batch and recall data
  • Signed store‑and‑forward events, original timestamps
  • Under a second, online or offline
  • SMS short code for any phone
Who uses it

Seven stakeholders. One repository. Each gets a tool built for its job.

National overview

What has been serialised, verified and dispensed, the live EPCIS event stream, alerts and recalls in one view.

  1. 1Designate the platform under the medicines act
  2. 2Load the product register and facility list
  3. 3Set phasing and alert rules; train inspectors
Live in the sandbox pilot · month 1
Regulator console
How traceability is built

Five layers. One job each. Published interfaces between them.

1 · IdentityCode on the pack

GS1 DataMatrix on packs, SSCC on pallets, master data synced with the register.

2 · EventsWhat happened, where

EPCIS 2.0 events from APIs, warehouses and the field app — including offline.

3 · RepositoryOne national store

In‑country, regulator as controller, ISO 27001, role‑based access.

4 · RulesExceptions and recalls

Duplicate, expired, recalled, unknown, diverted; permit matching; fee ledger.

5 · SurfacesTools for each role

Console, portal, tablet, workstation, phone app, SMS, claims feed.

The pack journey

One code. Five events. Factory to patient.

The manufacturer gives the pack its identity

A unique serial is printed with the product code, batch and expiry; the commissioning event reaches the national repository through the portal or API.

WhoMAH or manufacturer
RecordedGTIN, serial, batch, expiry
StandardGS1 SGTIN · EPCIS
The platform

One repository, seven surfaces.

Planning

Size a national programme in a minute.

Indicative — the pre‑feasibility study replaces these with the country’s own data.

240Mmedicine units a year
1.2bnsupply‑chain events a year
8,760verification devices
US$ 3.6Mannual fee pool
Government, public facilities, prescribers and patients pay nothing in a self‑financing model. Rollout runs in three annual phases.
Funding, ownership, control

Three ways to fund it. One answer on data: it is the Government’s, and it stays in the country.

Self‑financing PPP

An operator finances, builds and runs the platform, recovering the investment through a per‑pack industry fee of about 1% of the market.

10–15 years, then handover

Government‑procured

The regulator licenses the platform and in‑country hosting; Verofax implements, integrates and runs the managed service.

3–5 year agreements

Donor‑funded phase

A programme‑scoped pilot (HIV, TB, malaria) that proves the model and seeds the national repository.

12–24 months to decision
①Regulator is data controller

Operator is processor only.

②Hosted in‑country

Primary and DR in a Government data centre.

③No commercial use of data

Audited yearly; step‑in rights; code escrow.

④Handed over at end of term

Platform, infrastructure and data, at no cost.

Track record

Proven in a national Ministry of Health pilot.

0commodities serialised and tracked
0tracking accuracy
0losses in transit or at facilities
8–10 daysto deploy a facility
All MOU milestones achieved; pilot completed on schedule.Ministry of Health, Zambia — 14 November 2024
Hospital pharmacy store room during the pilot
Getting started

How ready is your country? Tick what is already in place.

0/6

Tick what you already have. The rest becomes the first workstream of the pre‑feasibility study.

Questions ministries ask

Straight answers on the points that decide a programme.

What happens when a dispensary has no network?
The app verifies from an encrypted local cache and queues the event; when connectivity returns, events sync with their original timestamps. Feature phones use the SMS short code.
Will manufacturers need to change their packaging?
Most will not: the GS1 DataMatrix is already required by the EU, US, Saudi Arabia, Egypt and India’s export rules. Others receive a phased deadline by product class.
Who owns the data, and where is it hosted?
The regulator is controller and Government owns all data; primary and DR sites are in‑country. The operator is a processor only and hands everything over at the end of the term.
Does this replace our hospital or logistics systems?
No. They connect through GS1, EPCIS 2.0 and HL7 FHIR interfaces, via the national interoperability layer where one exists.
Why one operator rather than several?
Traceability works when every event lands in one place. Exclusivity, where chosen, covers only the repository; equipment and software stay an open market.
How long from decision to national coverage?
About six months for a sandbox pilot at no cost, then three annual phases — most countries reach full coverage in the third year after regulations are gazetted.

Request a technical session for your ministry or regulator.

Sixty minutes on architecture, GS1 onboarding, offline verification, data sovereignty and funding models — with a live demonstration.

Book on CalendlyContact us
Used only to arrange the session. Privacy policy.