Cold-Chain Provenance: On-Chain Telemetry vs Merkle Anchoring

No - anchor, do not store. Do the arithmetic before the architecture debate: 1,000 consignments × 86,400 readings = 86.4 million readings a year. Each reading as a ledger entry carries the payload plus transaction and signature overhead - realistically a few hundred bytes replicated to every peer. Even at 250 bytes, that is over 20 GB a year of ledger growth before indices and backups, multiplied by the number of full peers (say 11 organisations plus the regulator), and it grows forever. If readings live in contract storage, each write consumes a storage slot and pays the associated gas-equivalent cost; the network becomes an expensive time-series database with no query language.

Better design:

• Telemetry stays with the logger provider and VaxLine's existing time-series store, which already supports queries, retention tiers, and correction.
• Each consignment's readings are hashed per hour (or per batch) into a Merkle tree; the root plus the consignment ID, logger device ID, time window, and record count are committed on-chain.
• On dispute or regulator request, VaxLine presents the raw readings and the Merkle proof, which any party can verify against the on-chain root in seconds.
• Result: roughly 1,000 consignments × 30 days × 24 hours ≈ 720,000 anchors a year instead of 86.4 million writes - a two-order-of-magnitude reduction with the same tamper-evidence property.

What is genuinely gained: the root is fixed at the time of receipt, so a 31-day dispute can no longer be argued about which spreadsheet version is authoritative. That is the benefit to bank, and it maps directly to the USD 2.4 million.

What is not gained: integrity of the raw file before hashing. If the logger vendor can rewrite its own archive and re-derive matching roots before the next anchor, the anchor proves nothing - which is why anchoring cadence and logger firmware attestation matter.

Immutability and erasure are compatible if personal data is never on-chain and the link is made revocable. The design rule: on-chain goes only non-personal data and salted commitments.

Concretely:

• Trial subject identifiers are replaced on-chain by a keyed hash, H(salt_subject, subject_id), computed by the manufacturer, which is the controller. The salt lives in the manufacturer's access-controlled store, not on the ledger.
• Erasure is executed by destroying the salt for that subject, which makes the on-chain commitment non-linkable going forward (crypto-shredding). The hash itself is no longer personal data in a meaningful sense once the mapping is gone.
• Shipment-level records that are needed for regulatory retention (temperature excursions, custody handoffs) are kept, because pharmacovigilance and GxP obligations give a lawful basis; the erasure analysis must distinguish trial-subject personal data from shipment records that a regulator requires.
• If the consortium insists on a visible audit trail of erasure, record a tombstone event ('salt destroyed, request ref X') without the identifier.

Governance to make this defensible: a data protection impact assessment covering the ledger, a controller/processor map that names the manufacturer as controller and VaxLine as processor, a retention schedule per data category, and a written rule that no new field may be added to an on-chain record without a DPIA sign-off. Without that, the vendor's 'one immutable truth' framing will collide with the second erasure request, and the programme will be stopped by legal rather than by technology.

The benefit hypothesis. The USD 2.4 million is not a technology cost; it is the cost of disagreement - 31 days of claims handling, duplicated records, and write-offs taken to avoid argument. Anchoring shortens the argument, not the shipping.

Value drivers and what must be true:

1. Dispute resolution time falls from 31 days to under 5. Must be true: the counterparty accepts the anchored root as authoritative, and the contract says so. If partners still demand an independent surveyor, savings evaporate.
2. Excursion response within the regulatory 24 hours becomes routine. Must be true: the temperature logger feed is integrated and monitoring, not manual. This is an operations project with a blockchain component, not the reverse.
3. Reduced write-offs on disputed spoilage. Must be true: the manufacturer's quality team signs off that Merkle-proven records satisfy GxP data integrity expectations (ALCOA+). Get this in writing before build.
4. Onboarding cost does not swamp the benefit. Each of the 10 partners needs keys, identity, and an operating procedure; budget it explicitly.

Costs to state honestly: integration with six CMOs' heterogeneous loggers, the anchoring service, partner onboarding, the DPIA and legal work, and a two-year run cost. No token, no fee market.

Metrics: median days to close a temperature dispute; percentage of excursions with evidence delivered within 24 hours; disputed-claim value written off per year; partner onboarding time; and the fraction of consignments whose anchor verifies against retained raw data during quarterly audit. Kill criterion: if dispute time does not fall below 10 days within two quarters of onboarding the top three partners, stop expanding.