Questions:
1. What happened to throughput when lots of devices were present? There's only so much airtime, and generally speaking wireless performance craps out when there are lots of devices.
2. Since they're using a normal phone as their base station, how do different phones perform in their environment? Using normal phones mean they can't tune the bluetooth stack behavior.
3. Using the same sets of chipsets for testing is great, but you should use many different chipsets because that's what you see in reality. Also putting them in one place is unrealistic.
4. Do they have a/b firmware with auto fail back on failure? How about signed firmware?
5. How are they going to manage their devices in production? Hospital IT is a combination of lax security for users but strict security for vendors. Will you be able to poke a hole? And the idea of using any phone, while appealing, will probably need to be heavily vetted.
6. Since the devices are two-way, how are you securing the devices against fuzzing etc? BT stacks can have all kids of issues. That's not including the stuff you guys write. Since it's BT, how are you doing client auth? And is data encrypted between the device and base station (ie: the phone with the app)? Where does that key come from?
Blah blah blah. What about provisioning? Remote management?
And 100 devices is probably not be enough. I see at least 20 devices around me right now on BLE, and I'm just at home. In a mall there are probably hundreds at any given spot. In your target environment, who knows?