Product Design · CLEEN by Leucine · 2020 — Present
Four years inside a compliance system.
Six versions out.
CLEEN is Leucine's cleaning-validation platform for pharma manufacturers. I joined Leucine in 2020, took CLEEN as the only designer in 2021, and led design through six versions across four years — from inherited architectural debt to a Feb 2026 structural rebuild used by 60+ pharma enterprises across 250+ GMP facilities.
Role
Product Designer (2020–2025) → Lead Designer (2025–Present)
Timeline
2020 – Present (4+ yrs on CLEEN)
Team
1 (2021–23) → 5 (2023–25) → Lead of 5 (2025–)
Scope
Enterprise SaaS, Regulated Workflows
Background
Day one. No pharma background.
A regulated SaaS where wrong UI is a wrong audit.
Leucine in 2020 was a 15-person startup with two products: CLEEN (cleaning validation) and DWI (digital work instructions). CLEEN was the flagship — built in 2019 from founder vision, served by a UI designer who pushed pixels, no UX discipline, no research. I spent year one on DWI. In 2021, when Leucine's first design hire took DWI off me, I moved to CLEEN as the only designer.
I had no internal docs and no pharma context. I Google-searched my way into HBEL-based limits, MACO, ARL, 21 CFR Part 11, GAMP 5. Sat in on customer calls. Rebuilt my mental model of “what users need” from scratch — because the users weren't optimising for productivity. They were optimising for defensibility. A wrong decision in the interface leads to a wrong decision in cleaning — a wrong decision in cleaning leads to an FDA 483 or worse. That constraint shaped every later decision.
CLEEN ran on the founder's 2019 visual system through 2021. From 2021 onward I rebuilt the design language module by module; the codification of those four years is the system shipped in five days as the Leucine Design System (Aug 2025) — not the system CLEEN was built on.
Impact
Six versions shipped. Six module redesigns including two built from scratch. The Feb 2026 rebuild lifted the original product's design ceiling — the same primitives drawn in 2021 today run cleaning validation across 60+ pharma enterprises and 250+ GMP facilities.
Customer and facility counts as of Feb 2026 deployment data.
The complexity ceiling
CLEEN had a vision.
It didn't have a model.
CLEEN v2 — original 2020 shell. Modules in place, fields correct, relationships wrong. Replace this placeholder with an old-UI export when available.
The founder knew what CLEEN needed to do. Modules were already defined — Master Data, Production Data, Limit Policies, Risk Assessment. Customers were onboarding. But the interface was built top-down from vision, not bottom-up from how a QA reviewer actually moves through a cleaning lifecycle.
Screens had the right fields. The fields had the wrong relationships. A QA reviewer validating a protocol would hit six modals, three modules, and two URL schemes to answer one question: is this limit defensible?The product was growing. The mental model hadn't caught up.
The four-year mandate
What CLEEN had was a complexity ceiling — a point past which adding features made the product worse, not better. My job was to raise it. For four years.
Four years, six versions
I didn't arrive with a redesign pitch.
I shipped what CLEEN needed next. The work accumulated.
2021 · First ship
Custom Reports
Pharma QA lives and dies by reports. The existing CLEEN had no way to design reports that matched a customer's own templates. I designed a modular, block-based report builder with drag-to-reorder and variable binding against live data. Two months. First module I owned end-to-end.
2021 → 2022
On-Demand Studies
Cleaning validation isn't a one-off event. Verification, monitoring, bracketing, recovery — each with its own protocol structure and acceptance criteria. I designed a study-design workspace that treated the study as a first-class object instead of a one-off form.
2022 → 2023
Validation Tracker rebuild
The original tracker was a flat list. Real work doesn't live in a list — it lives in a timeline, across campaigns, against equipment, with approvals halfway through. I rebuilt the tracker around the validation study, with every protocol run, sample result, and sign-off linked to it. Kept the flat list as a parallel view for one release after customer push-back; three months later the list was removed by customer request — see Chapter 1.
2023 onward
Offline Studies + module rebuilds
Customers run cleaning studies on the plant floor — often without network. I designed an offline-first sampling flow that syncs back when connectivity returns, with conflict resolution and signature capture in the field. Then I rolled through the older modules — Master Data, Limit Policies, Process Train Mapper.
Feb 2026 · Structural rebuild
v6 — the ceiling raised
Status-as-region (not a column), analytical surfaces alongside transactional, AI-recommended worst-case selection scoped narrowly to where defensibility is recoverable not where it lives (see Chapter 5), and a cross-referencing audit portal. Not a re-skin — five structural shifts that changed what the product could be.
The work
What four years of compounding produced.
CLEEN v6 today — eight surfaces shipped post-rebuild. Same primitives drawn in 2021 (master/instance, formula-as-UI, structured diff, status-as-region). New modules. Higher ceiling.
Version arc
v2 (2020 founder build) → v3 (Custom Reports, first redesign) → v4 (On-Demand Studies, audit-trail primitive) → v5 (Validation Tracker timeline, offline studies, module rebuilds) → v6.0 (Feb 2026 structural rebuild) → v6.3 (current)
Studies — every cleaning study is a first-class object: protocol → runs → samples → reports.
Validation Tracker — status is a region, not a column. Analytical view sits beside the transactional log.
Protocol Builder — restructured around the protocol designer's actual flow, not the data model's storage order.
Validation Protocol — every field knows its acceptance criteria; every revision routes to the right approver.
Residue Tracking — automated limit comparison with explicit value-type handling (BDL / BQL / actual).
Risk Assessment — toxicity-driven worst-case scoring; AI suggests mitigations from historical outcomes with a visible 'why'.
Hold Time Studies — dirty- and clean-hold windows with statistical validation and trend overlays.
Audit Portal — every residue result links to the protocol that required it, the risk assessment that justified the limit, and the approval chain that signed it off.
Design decisions
Six decisions that did disproportionate work.
Four years of redesigns produced hundreds of micro-decisions. These six shaped how users think about the product — and the Feb 2026 rebuild was built on top of them, not around them. These six are the decisions every later module's design depends on; pull any one out and v6 doesn't ship as it does.
Some patterns have industry lineage — three-level inline expansion shows up in Linear and Notion, selection-scoped FAB in Notion and GitHub, formula-as-UI in spreadsheets and Notion math blocks. The contribution here isn't pattern invention; it's the cleaning-validation adaptation — what audit-trail, defensibility, and 21 CFR Part 11 force you to change about each pattern.
Decision
What it reveals
Render the formula as the UI for cleaning limits
I think QA reviewers can't sign off on math they can't see. Inputs sitting inline inside the equation (ARL = (SF × MTD) / (MDD × SSA)) means a reviewer audits what the system computes, not what someone typed.
No-code risk-formula builder per customer
I think customer-specific risk models belong in the product, not in engineering tickets. Every pharma company runs its own toxicity / cleaning-difficulty / surface-class weighting. Letting QA compose their own formula moved a support burden out of engineering and a trust burden out of onboarding.
Dual-pane equipment picker for Process Train Mapper
I test against the workaround. With 200+ pieces of equipment and 40+ trains, single-pane search forced users into Excel. Dual pane — catalogue left, train right, drag to assign — made the in-product path faster than the spreadsheet route. That's the pass/fail bar.
Three-level inline expansion for Productions
I think regulated review is comparative, not navigational. Reviewers compare runs across batches across products. Expanding rows three levels deep keeps all three contexts on one surface. Navigation problem turns into a scanning problem.
Quick-Actions FAB scoped by selection state
I think the right question for a 60-action product isn't 'where are all the things' — it's 'what are the things I can do right now.' One button, contextual contents, no per-row menu sprawl.
Structured field-level diff for Change Assessment
I think regulators don't ask 'did you change this' — they ask 'prove it.' Every policy edit produces a structured before/after diff, frozen into an archived PDF, linked from the audit portal. Free-text reasons are not evidence. Diffs are. Cost the eng team an audit-trail subsystem and a frozen-PDF renderer; I owed them the structured pattern, not the implementation.
Formula-as-UI — Limit Policy
Structured diff — Change Assessment
Context
Six versions, validated by the auditor's eye.
Cipla
Dr. Reddy's
Zydus
Lupin
Teva
Aurobindo
Sun Pharma
Glenmark
Torrent
60+ pharma deployments across 250+ GMP facilities. Customers include nine of India's top-twenty pharma companies and multiple US/EU multinationals. Names shown are representative, not exhaustive.
Commercial frame
Most pharma still runs cleaning validation in Excel + paper SOPs. The vendor field is shallow; horizontal QMS suites treat cleaning as one of many modules. CLEEN is cleaning-native — the primitives are tuned for HBEL, MACO, BDL/BQL, and 21 CFR Part 11 from day one.
| Vendor | Implementation | Risk profile |
|---|---|---|
| Veeva Vault QMS | 12–24 mo | Heavy IT integration; cleaning-validation modules retrofitted |
| ValGenesis VLMS | 9–18 mo | Validation lifecycle focus; cleaning is one of many domains |
| In-house + Excel | — | Most pharma still runs cleaning validation in Excel + paper SOPs |
| CLEEN by Leucine | 2–6 mo | Cleaning-validation native; 60+ pharma deployments |
UAT — QA Head, top-five Indian pharma
For the first time I can explain our cleaning limits to my auditor without opening a spreadsheet beside the screen.
Limit Policy redesign, formula-as-UI pattern. Quoted from session notes — paraphrased.
Scope boundary
What I designed is the interface layer — how the product reasons visually, what gets surfaced, what gets hidden, and how the system explains itself to its users and the auditors who inspect them. The data model, computation engine, and 21 CFR Part 11 signature infrastructure were built by the founding engineers; the regulatory frameworks (FDA, EMA, ICH, WHO) belong to the regulators, not me.
Closing
60+ pharma enterprises today run their cleaning validation on the primitives drawn in 2021. The ceiling was raised because the same designer kept raising it — module by module, version by version, for four years.
Deep dive
Inside the four years,
for readers who want it.
Chapter 1 · The push-back I remember most
The Validation Tracker was a flat list.
I proposed killing it.
Before — flat list (v3)
CLEEN v3 — Validation Tracker as flat list. Replace with old-UI export when available.
After — study-anchored timeline
What it taught me
Not all push-back is to be overcome — some of it is to be negotiated into a sequence. I shipped the timeline as an additional view first, with the list kept for one release. Three months later the list was removed by customer request.
Chapter 2 · The line that validated formula-as-UI
One sentence in UAT
became the pattern I defended in every later module.
QA Head — top-five Indian pharma · UAT session
For the first time I can explain our cleaning limits to my auditor without opening a spreadsheet beside the screen.
One line. From that point on, “if the reviewer can't defend it live, it isn't done” became the bar I held every later module to — risk formulas, change assessment, residue tracking. Defensibility is the design constraint, not a QA-side checklist.
Chapter 3 · Why the team scaled the way it did
Solo for two years was a deliberate cadence,
not a resource shortage.
2021 → 2023
Solo on CLEEN
First two years as the only designer on the product. Architectural debt required one consistent mental model to be paid down. Adding designers earlier would have doubled the inputs to the debt.
2023 → 2025
Scaling the design org
Second designer on CLEEN, third on the cross-product design system, fourth as generalist. Modules got handed off only after the design system was legible enough that I didn't have to re-explain first principles weekly.
2025 onward
Lead designer · team of 5
Promoted to lead the design function across CLEEN, DWI, and the shared system. Four years from solo to leader on the same product — same primitives, same product, scaled team.
By the time the second designer joined in 2023, the design system was legible enough that they could take modules end-to-end without me re-explaining first principles weekly. Hiring earlier would have duplicated the architectural debt across more pairs of hands.
The Feb 2026 rebuild — the one that lifted the ceiling — was specced and shipped by the same designer who'd lived in CLEEN for four years. A junior in year-one couldn't have specced it; a senior consultant in year-four couldn't have either. That difference is what four years of tenure buys.
Chapter 4 · The audit portal and seven report types
Seven reports.
One evidence graph underneath.
The Audit Portal exports seven report types — Cleaning Validation Summary, Cross-Contamination Risk Assessment, Change Control, Deviation Summary, Training Evidence, Trend Analysis, and the Master Audit Package (all seven bundled). Each has its own template, variable bindings, and approval chain. The seven aren't seven outputs — they're seven stable views onto the same evidence graph. Auditors navigate the graph; teams stop assembling binders.
Chapter 5 · AI in the rebuild — scoped narrowly on purpose
Where defensibility lives
is where non-determinism does not.
Where AI ships
Worst-case product selection (toxicity / solubility / cleaning difficulty rankings). Risk-mitigation suggestions from historical outcomes. Every recommendation is labelled, justified, and overrideable.
Where AI does not ship
Audit trail. Signature chain. Limit computation. Anywhere a regulator asks “prove it” — the answer is deterministic, not probabilistic.
Chapter 6 · The BDL / BQL / actual dropdown
One small typed dropdown
removed an entire class of error.
Residue results have three value types: Below Detection Limit, Below Quantification Limit, or numeric. The old UI treated this as a free-text field. I moved it to a typed dropdown — numeric input only appears when “actual” is selected, and every downstream limit comparison knows which type it's reasoning about. Small pattern. Removed an entire class of data-entry error and the audit findings that came with it.
Chapter 7 · What I did not own
The boundary, stated plainly.
I did not write the core product architecture — the data model, the computation engine, the 21 CFR Part 11 signature infrastructure. Those belong to the founding engineers. I did not invent cleaning validation as a practice or the regulatory frameworks CLEEN implements — those belong to FDA, EMA, ICH, WHO. What I own is the interface layer: how the product reasons visually, what gets surfaced, what gets hidden, what order users move through, and how the system explains itself to its users and to the auditors who inspect them.
Chapter 8 · What I'd do differently
Three lessons I'd hand to anyone
starting a regulated-domain product tomorrow.
01
Build the audit-trail primitive in year one
Field-level diff with forced reasons and frozen archived PDFs didn't ship until v4. Every module before it would have benefited. Two years of per-module edit histories had to be retrofitted. The audit-trail primitive belongs in year one, before any module needs it.
02
Make defensibility the design constraint, not a checklist
If the QA reviewer can't defend the screen to an auditor live, the screen isn't done. Holding that bar from day one would have killed half the early UX detours. Formula-as-UI was the lesson; it should have been the rule.
03
Hire the second designer only after the system is legible
Two years solo wasn't a resource shortage — it was the time the architecture needed to harden. Hiring earlier would have duplicated the debt across more pairs of hands. Scale the team in step with the system, not faster.
Audit-trail in year one. Defensibility as the constraint. Team scaled in step with the system. Three lessons retrofitted into CLEEN over four years — three I'd apply on day one of the next regulated-domain build.