Sandbox profile
Medical information letters
Medium intensityA small pharma team drafts medical-information replies from approved labeling, on infrastructure it owns.
- Vertical
- Pharma
- Scale
- Small company
- Organization
- Northline Therapeutics
- Shape
- Specialty pharma, about 180 people, one approved product.
The business problem
Medical information answers the same questions about one label, in careful language, with a documented review. Headcount is a handful of people. A public model is a non-starter once a letter mentions a patient, and even a de-identified letter should not train someone else’s weights. They want a first draft from the current label and approved response documents, then a medical reviewer’s signature.
What Grae SI recommends
Family
Qwen 2.5 Instruct
Size
7B. A 3B model loses label constraints. Larger than 8B is wasted on a single-product corpus.
Why this size
The job is retrieval-grounded drafting against a short, approved corpus. A small model with a LoRA on past approved letters stays inside that fence if the eval checks for claims that are not on the label. BioMistral or Meditron are optional only when the license allows redistribution and the team accepts the extra review.
License
Domain models often carry non-commercial or share-alike terms. If the license blocks redistribution, the card says so and the default is Qwen 2.5 7B.
Data controls
PHI and inquiries
Many letters have no patient data. When an inquiry does, it is PHI or personal data. Those fields are masked before a letter is eligible for training.
De-identification
Requester identity, patient initials, and dates of birth are removed from the training extract. The live draft may quote the inquiry only inside the med info tool.
Access
Medical information and the reviewing physician or pharmacist. Promotional teams do not get a login to this model.
Residency
US VPC for a US label. If an affiliate in the EU asks a question, that traffic stays in an EU zone or does not use this model.
Retention
The signed letter follows the company’s medical-information record schedule. Training rows are versioned with the label they came from and retired when the label changes.
Risk classification
Intensity is a planning tier for evidence. It is not a certification and not a regulatory classification.
- A qualified reviewer signs every letter, and the corpus is approved labeling plus prior approved replies.
- Inquiries can contain patient details, so the floor is not low.
- The tier becomes high if the letter is used promotionally, or if it interprets an individual patient’s care without a medical reviewer.
Compliance requirements to prepare for
FDA medical information practice
Replies should stay consistent with approved labeling and the company’s own med info procedures. Grae SI does not clear promotional claims.
21 CFR Part 11
Applies when the signed letter and the audit trail are electronic records in a regulated quality system. The signature system is the company’s, not Grae SI’s.
GxP
The model version, dataset, and eval belong in the quality record if QA decides this tool is in the GxP scope. That decision is theirs.
ISO/IEC 42001 and SOC 2
42001 for the AI system. SOC 2 evidence if partners ask. Neither is an attestation from Grae SI.
GDPR or DPDP
If inquiries come from the EU, UK, or India and contain personal data, purpose, residency, and retention follow those laws. A US-only product can mark them as not in scope until that changes.
Grae SI helps assemble the evidence. It does not certify HIPAA, FDA, ISO, SOC 2, ICH, NAIC, GDPR, DPDP, or any other framework.
Validation KPIs
These are targets to lock before go-live. They are not measured outcomes from a customer deployment.
On-label rate
100% of claims in the gold set trace to the current label or an approved document
An off-label sentence is a release blocker, not a style issue.
Reviewer acceptance
75% of drafts sent to review with no factual change
Wording will still be edited. Facts should not be.
Identity leak
No requester or patient identifiers in the training extract, checked on 40 rows
The live tool can hold the inquiry. The training file should not.
Label freshness
Model card shows the label version, and a new label forces a new eval
A draft against a retired label is a defect.
Deployment architecture
Label store and the med info mailbox sit in the company’s cloud account. The model serves on a private endpoint. Training reads only the approved corpus plus masked historical replies.
01
Label and approved letters
Source of truth. Versioned. The job refuses to train if the label id is missing.
02
Masking
Inquiry identifiers stripped before a row can enter the dataset.
03
Grae SI train and eval
One 7B LoRA job. Eval checks on-label claims.
04
Med info tool
Reviewer sees the draft and the label citation, then signs in the existing system.
Each box is a component in the customer’s network. Arrows are the order of the path, read left to right on a wide screen and top to bottom on a phone.
Where this sits in the stack
The same ten layers appear on every profile. The mark says whether Grae SI provides the layer, shares it, or leaves it with you. Person-weeks are the buyer’s effort after the runtime is deployed, not a project plan for the whole company.
- Grae SI providesGrae SI provides the layer
- SharedShared. Grae SI supports part of it.
- You ownYou own the layer after install
- You own
Layer 1
Infrastructure and compute
A private VPC or an air-gapped quality zone. No training call to a public API.
Buyer effort after the runtime is up: 1–3 person-weeks
- Shared
Layer 2
Data ingestion and prep
Grae SI shows what the safety or labeling corpus needs. Your RIM or safety database produces the extract.
Buyer effort after the runtime is up: 2–5 person-weeks
- Shared
Layer 3
Data controls and governance
Subject and reporter identifiers are masked before training. Part 11 retention of the signed record is yours.
Buyer effort after the runtime is up: 1–3 person-weeks
- Grae SI provides
Layer 4
Model selection and training
Qwen 2.5 7B from the catalog unless a domain model’s license is acceptable. Local PEFT is enough at this size.
Buyer effort after the runtime is up: 0.5–1.5 person-weeks
- Shared
Layer 5
Evaluation and validation
Medium suite plus an on-label check against the current label. A medical reviewer samples failures.
Buyer effort after the runtime is up: 1–3 person-weeks
- Shared
Layer 6
Agents and orchestration
Compliance agents that classify the use case and name the frameworks to prepare for. Any production agent that calls tools inside your applications.
Buyer effort after the runtime is up: 1–2 person-weeks
- Grae SI provides
Layer 7
Deployment and serving
Safetensors, GGUF, a model card, and an offline bundle for Ollama, vLLM, or llama.cpp. Moving that bundle into the zone and keeping the host patched.
Buyer effort after the runtime is up: 0.5–1.5 person-weeks
- Shared
Layer 8
Monitoring and drift
Registry lineage: version, dataset, eval result, and the package that was released. Live traffic checks, drift alarms, and the decision to pull a version.
Buyer effort after the runtime is up: 1–3 person-weeks
- You own
Layer 9
Application and integration
Start inside the mailbox the team already uses. Do not build a new med info suite for the pilot.
Buyer effort after the runtime is up: 2–5 person-weeks
- You own
Layer 10
Organizational validation and sign-off
QA and medical information agree the intended use. Part 11 controls stay in their quality system.
Buyer effort after the runtime is up: 2–4 person-weeks
Buyer effort for this profile
5–9 person-weeks
A 180-person company should not staff a model platform. The work is the label corpus, the gold set, and a short QA review.
- Medical information lead
- Quality
- One engineer who can run a private GPU node
Quantitative benefits
Illustrative estimate for this sandbox. It is not a measured customer result. Assumptions for this profile are listed under the figures.
Time to a reviewable package
4–6 weeks
One product, one label, one reviewer pool. Building the same loop with a general vendor and a validation writer is often a quarter.
Cost versus a cloud API
About $2k–$6k a month avoided
Illustrative: 3,000 letters a month, long label context, $0.7–$2 a letter on a hosted model. Patient-level inquiries would be out of policy on that API.
Compute
$400–$900 a month
One small GPU node in the company’s existing cloud account, stopped when no job is running if their FinOps practice allows it.
Validation writing
About 1–2 person-weeks saved
Model card and eval export. SOP edits are still QA’s.
Accuracy target
100% on-label on the gold set
A release gate, not a field measurement.
Assumptions
- Illustrative estimate for this sandbox. It is not a measured customer result.
- Volume is 3,000 inquiries a month for one product. A launch spike needs queueing, not a bigger base model.
- Promotional review is out of scope. This model does not write sales materials.
- License terms of any biomedical base model are accepted by counsel before that base is selectable.