4 November 2026 - Xavier Flanagan, Founder

How to get a copy of your medical records in the UK

If a GP surgery, hospital, dentist or private clinic in the UK holds records about you, you have a legal right to a copy. Not just what the NHS App shows. Consultation notes, letters, test results, scan reports: everything they hold about you.

The right comes from UK data protection law, and it works the same way in England, Scotland, Wales and Northern Ireland. The request is called a subject access request, and it is usually free.

The short version

You can ask any health provider, NHS or private, for a copy of the information they hold about you. You can ask in writing, by phone or in person, and you do not have to use the words “subject access request”.
They must respond within one month. They can extend that by up to two more months only if your requests are complex or numerous, and they must tell you why within the first month.
It is free. A fee is allowed only if a request is manifestly unfounded or excessive, for example repeated requests for the same thing, or if you ask for further copies.
If they refuse or ignore you, complain to them first, then to the ICO, the UK’s data protection regulator.

What the law says

The right of access is Article 15 of the UK GDPR, with the timing set by Articles 12 and 12A as amended by the Data (Use and Access) Act 2025. It covers all personal data a provider holds about you, and health records are personal data.

The clock starts when they receive your request. It can pause in two situations: while they confirm who you are, and, if you hold a lot of records with them, while they ask you to say which ones you want. Being specific up front saves time.

There is one exemption that matters most for health records. A provider can hold back information if the appropriate health professional judges that giving it to you would be likely to cause serious harm to your physical or mental health, or someone else’s. Information that identifies another person, such as a relative who told your GP something, may also be withheld (Data Protection Act 2018, Schedule 2, Part 3). Almost everything else is yours to ask for.

Start with the NHS App

In England, GP practices have been required since 2023 to give patients online access to new entries in their GP record, as they are added, through the NHS App and other approved apps. If you are registered with a GP and have an NHS login, you may be able to see recent consultations, test results and letters there already.

But the app is not the whole record. Older entries, entries from a previous practice, hospital records and private care are often missing, and some entries can be hidden. For those, you need a subject access request.

Scotland, Wales and Northern Ireland have their own apps and arrangements, and what they show differs. If yours does not show your record, use a subject access request.

How to make a subject access request

Ask the place that holds the records. Your GP surgery holds your GP record. Each hospital trust or health board holds its own records, and requests usually go to its medical records or information governance team. Private clinics and dentists hold their own.
Put it in writing if you can. A verbal request is valid, but an email or letter gives you a dated record. Many trusts have an online form; you do not have to use it.
Be specific. Say what you want, for example “my full GP record”, or “everything about my stay in March 2024”. If they hold a lot, they can pause the clock to ask you anyway.
Ask for an electronic copy. If you ask by email, they should give you the information in a commonly used electronic form (UK GDPR, Article 15(3)).
Note the date. The month runs from when they receive your request, or from when they have confirmed your identity.

If they refuse or take too long

If you are refused, they must tell you why, and tell you that you can complain to them, complain to the regulator, or go to court.

Since June 2026, every organisation must have a way to handle data protection complaints, and must acknowledge yours within 30 days. Complain to the provider first. If that does not resolve it, complain to the ICO, the UK regulator (since 30 September 2026 the Information Commission), at ico.org.uk.

Common situations

Someone who has died. Data protection law covers living people only. A deceased person’s records come under the Access to Health Records Act 1990 in England, Wales and Scotland, and the Access to Health Records (Northern Ireland) Order 1993 in Northern Ireland. Both let the personal representative, and anyone who may have a claim arising from the death, apply. The holder must respond within 21 days for records added in the last 40 days, and within 40 days otherwise. Under the 1990 Act no fee is required; in Northern Ireland a fee for copies is allowed.
Your child’s records. A parent can usually request a young child’s records. A child who is mature enough to understand their rights can make their own request, and a parent may then need the child’s agreement. In Scotland, a child aged 12 or over is presumed mature enough to make their own request (Data Protection Act 2018, section 208).
Records from a GP you have left. Your GP record moves with you when you register somewhere new, so ask your current practice.

Asking for mental health records? See how to get your mental health records in the UK, including when something can be held back.

Why the records are only half of it

Your history is spread across your GP, one or more hospital trusts, private clinics and dentists, and it arrives as PDFs, scans and paper. None of them shows you everything in one place.

That is where exora fits. Upload the records you get back, from any provider, and it reads them, pulls out your medications, conditions, results, procedures and vaccinations, and lays them out in plain language. Every fact links back to the page it came from, so you can always check it.

exora does not connect to the NHS or to your providers’ systems, and it does not request records for you. You get them, using the rights above, and exora puts them together. How exora handles your copy is set out in our privacy policy.