How a pharmaceutical company runs regulated content across 5 markets from 1 governed platform

Challenges

Every page carries required drug disclaimers, safety information, and adverse-event capture, present and correct in every market before anything goes live. A control an editor can forget is a compliance risk, so compliance had to live in how pages are built.

The same site serves two audiences who must not see the same thing. Patients and healthcare professionals need different medical content, and professional-only content has to stay behind verified credentials.

The platform also had to move off Drupal's core Layout Builder onto Acquia Site Studio, the visual page builder used across the company's global sites. This was the hardest part of the engagement. 

Layout Builder stored layouts as serialized PHP objects; Site Studio stores them as structured JSON built from component UUIDs, and nothing converts one to the other automatically. Every page had to be rebuilt across 26 component types, and translations had to move as language variants were added to the base content rather than overwriting it.

Approach

The team treated compliance as the fixed point the platform was built around. In regulated pharma, a page that looks finished but is missing a disclaimer is the real failure, so the controls for compliance, safety messaging, and audience gating were placed where they could not be bypassed, inside the editorial workflow.

That set the order of the work. Editors across many markets needed one visual system they could build in safely, which is why moving every page onto Site Studio was worth the cost of custom migration tooling.

Solution

Compliance built into the workflow

The required MLR disclaimer codes are placed automatically per page and per site inside the editorial workflow, so a page cannot be published without them. Important Safety Information is configured per site and per therapeutic area. 

The platform captures adverse events reported through any site in an FDA-compliant way, recording which site, operating unit, and environment each report came from. Compliance and safety reporting are part of the system, not a step an editor has to remember.

Two audiences, one site, enforced by credentials

Credential interstitials verify a user's professional status before granting access to HCP-only content, so patients and professionals see different content from the same site. 

Field representatives can still reach professionals directly: a shared link validates the representative's identity through Auth0 and bypasses the interstitial for that professional, which improves portal adoption without weakening the audience wall.

Layout and content migration onto Site Studio

QED42 built custom migration tooling that unserializes the Layout Builder data, recursively traverses nested block content and paragraph references, and re-expresses each page as Site Studio JSON, mapping more than 20 component types to their Site Studio UUIDs. 

Translations migrated without overwriting base-language content. On that tooling, the platform absorbed a large-scale migration of existing content, articles, pages, events, and media across five markets.

A shared system that launches new sites

A design system of more than 47 reusable components, from accordions and carousels to footnotes, key facts, and timelines, is shared across all country sites, which holds brand consistency and shortens launches. 

Site spinup and decommission run through a REST API that tracks which sites are active and who owns them, so a new market site is provisioned without manual infrastructure work.

Approved assets from Aprimo

Regulated images and PDFs are managed centrally in the company's Aprimo digital asset management system and pulled into the CMS, so teams use approved, versioned assets rather than local uploads.

Third-party integrations

The platform connects the systems each market depends on: Brightcove for video, SearchStax for search, Qualtrics for surveys, SMIT Unify for CRM, Adobe and Google for analytics, OneTrust for privacy and consent, and New Relic for performance monitoring.

Outcome

The company now manages regulated patient and professional content across five markets on a single platform. A page cannot reach the public without its required disclaimers and safety information.

A new country or brand site is assembled from the shared library of 47+ components, so a launch reuses the system instead of rebuilding it. Patient and professional audiences stay apart by verified credentials, while field teams reach professionals directly through identity-validated links.

‍