For Stakeholders

What this is

A small, low-risk SEO/crawler-configuration fix for clinic-web, the staff dashboard app. It stops search engines from indexing dashboard pages and tightens crawling of a few generated document types (exported PDFs, spreadsheets, photos).

Why it matters

clinic-web is login-gated business software, not public content. Having its pages indexable by search engines served no purpose and was, at minimum, an unnecessary information-exposure surface: page titles, URL structure, and potentially cached fragments could be visible to anyone searching, even though the underlying data always stayed behind login. This closes that gap using the standard web mechanism for it (robots meta tag + robots.txt).

Risk assessment

Impact if this ships as-is: none to staff or patients — no behavior change for any logged-in user, no data access change, no change to any other package (server, mobile, etc.).

Risk of the change itself: very low.

• It's two static files (index.html, robots.txt), no application logic.
• Worst case if misconfigured: either (a) the app stays indexable (status

quo, not a regression) or (b) a legitimate crawler is blocked from something it shouldn't be — verified in the sandbox that the app itself remains fully fetchable (Allow: /) and that logging in and navigating are unaffected. See Walkthrough.

• No irreversible action: crawler directives are advisory and can be

adjusted at any time by editing these two files again.

**What this does not address:** if clinic-web pages were already indexed or cached by a search engine prior to this change, this PR does not remove those existing entries — that requires a manual removal request through each search engine's tools (e.g., Google Search Console) against the my.dentolize.com domain. Worth flagging to whoever owns that domain's Search Console access, if anyone does.

Effort / scope

Two files changed, no schema, API, or dependency changes. No migration, no rollout coordination needed beyond a normal deploy.