How to check a design agency before you sign: reviews, references and results
Check a design agency like an investor: verified reviews, client calls, who does the work, real results, returning clients and contract basics.
1 Dec 2026
What hospitals check on your website before they take the meeting
Before a hospital takes the meeting, IT, procurement and clinicians check your site. A checklist of what they look for and how to pass.
Short answer
Hospitals check whether you’re safe to let in. They look for your regulatory status in exact words, a security and privacy page they can forward to IT, evidence written for clinicians, how you fit their systems and a real company behind the logo. If a buyer can’t find those in five minutes, the meeting goes to someone whose site can.
You’ve had a great first call. The surgeon loved the demo and asked for the link. Lovely. Now picture who actually opens it. Rarely the surgeon. It’s someone in IT security, procurement or value analysis, with your homepage in one tab and a vendor questionnaire in the other.
They’re not there for the hero animation. They’re hunting for a clearance number, a security page, a named customer and an address. Think home inspection, not open house.
And they have good reason to be thorough. In 2024, US regulators logged 663 health data breaches affecting 500 or more people, touching roughly 243 million individuals. Business associates, meaning vendors, filed 16% of those reports but accounted for 85% of the people affected. To a hospital, you’re a vendor first and an innovation second.
At Dtail Studio, a Barcelona design studio working with HealthTech and renewable energy startups, we spend a lot of time with founders who sell to clinicians, families and hospital buyers. Here’s what we’d check on your site before your next hospital meeting, plus what we’ve learned working alongside OXOS, the medical device company behind the MC2 portable X-ray system.
Who actually reads your website before a hospital meeting?
More people than you’ll ever meet. The clinician who championed you forwards the link, and from there it reaches procurement, IT security, compliance and often finance. Each of them opens a different page.
Build a HealthTech website only for the clinical champion and you’ve made a brochure. Build it for the whole committee and you’ve made a set of answers. Committees, sadly, don’t read brochures.
Supplier websites are where business buyers start. Gartner’s research on B2B buying found that buyers begin digitally and that suppliers’ websites are “the first stop in their information gathering”. In hospitals, that first stop is also the first filter.
What does the clinical champion need to find?
Your intended use, your regulatory status and your evidence, in their language. Someone will ask them “is this cleared?” in a meeting you’re not invited to, and your website is what they’ll pull up on their phone, probably under the table.
Regulatory status, worded exactly.
Say what is cleared or certified, for which use and since when. Don’t round up. “FDA cleared for paediatric imaging” and “FDA approved” are not the same sentence, and the reader knows it.Evidence they can cite.
Studies, pilots and outcomes, with a link to the source and the setting. A number with no context reads like a marketing claim.The workflow, not just the feature.
Show where your product sits in a real shift: who touches it, when, and what it replaces.
Why does IT security read your site so closely?
Because vendors are where the biggest breaches come from. The Change Healthcare incident alone affected about 192.7 million people, according to the US Department of Health and Human Services. Every hospital security team remembers it, the way pilots remember a bad landing.
So before they send you a very long spreadsheet, a security reviewer looks for signs that you take this seriously. A dedicated trust or security page does more than any badge in the footer. Say where data is hosted, which certifications you hold today (and which are in progress, worded honestly), whether you sign a Business Associate Agreement in the US or a Data Processing Agreement in Europe, and who to contact about a vulnerability.
If you make a connected medical device, there’s a regulatory reason too. Since March 2023, US law requires makers of “cyber devices” to give the FDA a plan to monitor vulnerabilities and a software bill of materials. Hospitals ask for the same things. Saying so on your site saves a round of emails.
What does procurement need without having to ask?
Proof that you’re a real, stable company they can sign a contract with. Procurement wants the legal entity name, an address, the leadership team, how support works, how long implementation takes and how you price.
You don’t have to publish prices. You do have to publish the model: per device, per seat, per site, subscription or capital purchase. A buyer who can’t tell which budget you come out of can’t put you on an agenda. Nobody wants to present a mystery to the finance committee.
Integration matters here too. If you connect to hospital systems, name the standards you support, such as HL7 FHIR for records or DICOM for imaging, and the systems you’ve already integrated with. “Integrates with everything” tells them nothing. “Works with these three PACS” tells them who to call.
Does design still matter if they’re only checking documents?
Yes, because design is how a reader decides whether the documents exist at all. In the same Gartner research, 64% of B2B customers said they couldn’t tell one brand’s digital experience from another’s. Generic sites look interchangeable, and interchangeable vendors get compared on price.
Hospital buyers have seen every stock photo of a smiling surgeon in a spotless corridor. It’s the website version of “trust me”, and it works about as well. Real product photography, real environments and plain words say more.
We wrote more about this in why HIPAA, MDR and accessibility make healthcare UI better: constraints that look like paperwork usually make the design clearer.
The hospital website checklist
Regulatory status.
Who checks it: Clinician, compliance. Pass if: Exact clearance or certification, intended use and date, one click from the homepage.Evidence.
Who checks it: Clinician, value analysis. Pass if: Every claim links to a study, pilot or named setting.Trust and security page.
Who checks it: IT security. Pass if: Hosting, certifications, BAA or DPA, vulnerability contact, all on one page.Integrations.
Who checks it: IT, clinical engineering. Pass if: Named standards and named systems, no vague promises.Company facts.
Who checks it: Procurement. Pass if: Legal entity, address, leadership, support hours.Pricing model.
Who checks it: Procurement, finance. Pass if: The model is stated, even if the price isn’t.Implementation.
Who checks it: Clinical lead, IT. Pass if: A realistic timeline with who does what.Customers.
Who checks it: Everyone. Pass if: Named references or approved anonymised descriptions.Contact.
Who checks it: Everyone. Pass if: A real person or team per topic, not only a form.
What we’ve learned working with OXOS
OXOS makes the MC2, a lightweight, wireless, portable X-ray system. In March 2026, its FDA clearance was expanded to paediatric imaging. That one sentence is exactly the kind of fact a hospital buyer needs to find in one click: worded precisely, with the date attached. The clearance is the OXOS team’s achievement. A good sentence just makes sure nobody misses it.
We work as part of OXOS’s creative team, which is why we read their site the way a hospital buyer would. The lesson from medical devices is that every claim gets read twice: once by the person who wants to buy, and once by the person whose job is to find a reason not to. A brand that holds up for both is built from precise facts, not adjectives.
“A team that feels like an extension of our own. Dtail Studio understands OXOS so well it’s like having an in-house brand team.” Evan Ruff, Founder and CEO, OXOS
If you’re still choosing who should build this with you, start with how to choose a design agency for a HealthTech startup. And if your product also has patients and families on the other end, the same honesty applies to them, which we cover in one app, two users.
FAQ
Should a HealthTech startup publish its prices for hospitals?
Publish the pricing model, not necessarily the price. Buyers need to know whether you’re a capital purchase, a subscription or a per-use cost, so they can route you to the right budget.
Do we need SOC 2 or ISO 27001 before we sell to hospitals?
Not by law, but security teams often ask for one of them. If you don’t have it yet, say which controls you do have and when an audit is planned. An honest “in progress” beats silence.
Can we name hospital customers on our website?
Only with written permission. Many hospitals restrict use of their name. An approved description, such as “a regional teaching hospital in the UK”, still helps.
Should the security page be public or gated?
Both. Keep a public summary that anyone can read and forward, and share detailed reports, policies and penetration test results under NDA.
The five-minute forward test
Open your homepage on your phone and set a timer for five minutes. Find your regulatory status, your security page, your integrations, your pricing model and a named contact. Anything you can’t find in that time, a hospital buyer won’t find either. That list is your next sprint.
Taking your product to hospitals and want a second pair of eyes on the site? We’re happy to take a look.
About the author. Slavena Vasileva is Brand Strategist and Partner at Dtail Studio, a senior brand and product design studio in Barcelona working with HealthTech and renewable energy startups. 16+ years, 300+ projects, 5.0 on Clutch.
Sources: HHS Annual Report to Congress on Breaches, Calendar Year 2024 · HHS Change Healthcare incident FAQ · FDA Cybersecurity in Medical Devices FAQs · Gartner on B2B digital buying · Diagnostic Imaging on the OXOS MC2
Should you rebrand after your Series A?
Leave it, refresh or rebrand? A decision framework for startups after a Series A, with the signals for each and lessons from the Cubee brand.
Why patients stop using health apps after week two, and how design keeps them
Most health apps lose their users within two weeks. The research on why patients drop off, and a design framework to keep them, with lessons from Elli Cares.
