· 4 min read · Updated
The Metrics Investors Check That Aren’t on Your Pitch Deck
A deck shows the numbers a founder chose to show. Diligence asks for the numbers that show how the company runs. Three of them matter most in healthtech.
Short answer. Diligence asks for numbers a pitch deck leaves out. Three matter most in healthtech: gross margin with delivery costs included, pilot-to-paid conversion, and the compliance record behind “HIPAA compliant.” Each takes longer to produce than the slide it supports, so keeping them current is operations work best done early.
A pitch deck shows the numbers a founder chose to show. Diligence asks for the numbers that show how the company runs.
The gap between the two is rarely about honesty. Most decks are accurate. They’re also selective, because a deck has twelve slides to tell a story and the operational detail behind each slide doesn’t fit. Diligence goes looking for that detail, and when it takes two weeks to produce, the delay becomes a finding of its own.
Three of those numbers matter more in healthtech than almost anywhere else.
A software-like gross margin
What does it cost to serve one more customer, people included?
A slide of health system logos
Which are paying, and how long did the pilots take to convert?
“HIPAA compliant”
Who owns compliance, and where is the record?
1. Gross margin, with delivery costs included
The deck says software margins
A healthtech product rarely ships as pure software. Someone configures it for each customer, builds the integration with the customer’s EHR, trains the clinical staff, and picks up the phone when something breaks. Those costs are real, and they often sit in operating expenses, or on the founder’s own calendar, instead of in cost of revenue.
Diligence rebuilds the margin from the bottom up. It asks what it costs to deliver the product to one more customer, people included. A company reporting a software margin can turn out to be a services business with software in it, because promises made in sales conversations (a custom integration here, a dedicated support contact there) never made it back into a cost model.
Have ready
A cost-to-serve model per customer, with implementation and support hours counted.
2. Pilot-to-paid conversion
The deck says a slide of health system logos
A pilot is cheap for a health system and easy to approve. A paid, multi-year contract goes through procurement, security review, legal, and a budget cycle. The distance between the two is where healthtech companies stall.
Pilots signed
Pilots completed
Paid contracts
Between completed and paid: procurement, security review, legal, and a budget cycle.
Diligence asks which of those logos are paying, on what terms, and how many pilots have converted. It also asks how long conversion took, because a twelve-month path from pilot to contract changes every forecast built on six.
Have ready
A list of every pilot with its start date, its status, and what conversion depended on.
3. The compliance record behind “HIPAA compliant”
The deck says HIPAA compliant
Worth knowing
HHS doesn’t certify HIPAA compliance. Third-party firms sell HIPAA certifications, but HHS doesn’t recognize them, and a certificate won’t stand in for the record if a breach occurs.
Diligence asks for that record: who owns compliance, when the last risk analysis was done (the HIPAA Security Rule requires one), which vendors have signed business associate agreements, when access was last reviewed, and what the incident log shows.
A company can be doing most of this right and still fail the question, because nobody wrote it down. Diligence reviews the record, and an undocumented practice looks the same as a missing one.
Have ready
A named owner, a dated risk analysis, a list of signed BAAs, and a compliance folder someone other than the founder can open.
The checklist
| The deck shows | Diligence asks | Have ready |
|---|---|---|
| A software-like gross margin | What it costs to serve one more customer, people included | A cost-to-serve model |
| Health system logos | Which are paying, on what terms, and how long conversion took | A pilot tracker with dates and status |
| “HIPAA compliant” | Who owns it, and where the record is | Owner, risk analysis, BAAs, access reviews |
Why this is an operations problem
None of these numbers is hard to calculate. They’re hard to produce on short notice, because nobody owns them. The margin lives partly in finance and partly in the founder’s head. The pilot history lives in email threads. The compliance record lives with whoever set up the tools two years ago.
Keeping these numbers current is operations work. Done early, it takes weeks. Done during diligence, it runs on someone else’s timeline.
If you’re not sure how quickly you could produce any of these three, a diagnostic conversation is a reasonable next step. Thirty minutes. No charge. You leave with a specific recommendation, even if it’s not me. Start there.
Alden Levy is the founder of Engine No. 9, a fractional COO practice for healthtech and medtech founders from Seed through Series B. He trained as a bioengineer at the University of Pennsylvania and holds an MBA from Wharton.