Trialith — a project by Ahsan Mahmood
Clinical-trial protocol intelligence SaaS for pharma sponsors and CROs — audit, simulate, and compile protocols into CDISC-ready EDC schemas.
A clinical trial protocol is a long document that people read and then retype.
It describes who is eligible, what happens at each visit, when those visits fall, what is measured and how the result will be judged. Then somebody reads it and builds the database that will collect the data, by hand, from the prose.
Two expensive things follow from that.
The first is that the retyping is slow, and a database build measured in weeks sits between a finished protocol and a study that can start. The second is worse: a document read by humans keeps its contradictions. Visit windows that do not quite line up. Eligibility criteria that conflict on an edge case.
A statement in one section disagreeing with a statement in another.
Those inconsistencies surface later as amendments.
An amendment is not a correction in a file. It means re-approval, re-training the sites running the study, and frequently re-consenting the people already enrolled in it. A meaningful share of them are caused by problems that were in the document from the first version and were simply not spotted by anybody reading it linearly.
Trialith's proposal is to treat the protocol as data instead.
If the protocol is a structured artefact on a standard model rather than prose, then three things become mechanical. It can be audited for internal contradiction. Its statistics can be computed from it, including simulated scenarios. And the data capture schemas can be generated rather than assembled by a person reading it.
Three engines, one for each.
Now the necessary sentence. None of them is built. The record puts this at Phase 0, with the foundation, the design system and a marketing landing page shipped and all three engines specified and on the roadmap. Everything above describes a design.
That matters more than usual here.
The audience is pharmaceutical sponsors and the organisations that run trials for them, which is an audience that evaluates claims for a living. A page overstating what exists would be found out immediately and would cost more than the honest version does.
Underneath, the foundation constrains everything else.
The protocol workspace is modelled on the industry's canonical standard rather than on a shape invented here, which is the decision that makes generated output usable by systems nobody controls. Access is enforced at the database, and the AI gateway is provider-swappable with the key supplied by the user.
No patient data enters it.
The design keeps it out entirely: a protocol describes how a study will run rather than who is in it, so the product works on study design rather than on any person enrolled in one. Private storage and row-level access are in the architecture anyway, because an unpublished protocol is commercially sensitive even when it contains nothing about anybody.
There is a second reason the standard model came first, and it is about who has to accept the output.
A schema this generates is consumed by systems built by other companies, to a specification nobody here controls. Inventing a convenient internal shape and translating at the boundary would have been faster to build and would have moved every compatibility problem to the point where it is most expensive to discover. Conforming from the start is slower and it is the only version that could ever be adopted.
What it cost is proof.
Three engines are named on this page and none of them runs. Building the standard model, the design system and the foundation first is the correct order, and it produces by some distance the least demonstrable milestone available. That is the accurate state. It is not a satisfying one.
What it does, and what that costs to build
- PACE engine: protocol consistency audit with visit-window, contradiction, and eligibility flags
- SIM engine: analytic power/sample-size and in-browser Monte-Carlo simulation
- COMPILE engine: USDM to ODM v2.0 and CDASH eCRF generation
- Protocol workspace on the CDISC USDM canonical model
- Branded landing page with a Schedule-of-Activities compiling animation
- No-PHI-by-design, HIPAA-ready architecture with RLS and private buckets
- Provider-swappable bring-your-own-key AI gateway
- Capacitor Android shell with Trapeze-managed native config
Built with
- React 19
- TypeScript
- Vite
- Tailwind CSS v4
- Radix UI / shadcn
- TanStack Router
- Zustand
- Supabase
- Cloudflare Workers
- Capacitor
- react-hook-form
- Zod
Worth knowing
- clinical-trials
- cdisc
- edc
- healthtech
- b2b-saas
- supabase
- cloudflare-workers
- react
What exists of Trialith today?
The foundation, the design system and a marketing landing page. The record calls this Phase 0 and says the three engines are specified and on the roadmap rather than shipped. So the protocol auditing, the simulation and the schema compilation described below are designed and not running. On a product aimed at pharmaceutical sponsors that distinction is not a nicety, since the people evaluating it would check.
What does treating a protocol as data change?
Everything downstream of it. A clinical trial protocol is normally a long document that humans read and then re-enter, by hand, into the systems that run the study. Treating it as a structured artefact instead means the inconsistencies inside it can be found mechanically, the statistics can be computed from it, and the database that collects trial data can be generated rather than built. The document stops being the end of the process.
What are the three engines meant to do?
One audits, one simulates, one compiles. The audit looks for the internal contradictions that force a protocol amendment later: visit windows that do not line up, eligibility criteria that conflict, statements that disagree with each other. The simulation computes statistical power and sample size, including by running scenarios in the browser. The compiler turns the standardised protocol model into the schemas an electronic data capture system needs.
Why does an amendment matter enough to build a tool against?
Because a protocol amendment is expensive and most of them are avoidable. It means re-approval, re-training sites, and often re-consenting participants, and a large share are caused by inconsistencies that were present in the document from the beginning and simply not spotted. Finding those mechanically before a study opens is a much cheaper intervention than correcting them once it is running.
Does it hold patient data?
No, and the record calls that no-PHI-by-design. A protocol is a description of how a study will be conducted rather than a record of anybody in it, so the product works on study design rather than on patient information. Row-level security and private storage are in the architecture regardless, because a sponsor's unpublished protocol is commercially sensitive even when it contains nothing about a person.
https://aoneahsan.com/projects/com.aoneahsan.trialith