5 November 2026 - Xavier Flanagan, Founder

How to get your mental health records in the UK

The short answer: yes. Your mental health records are personal data about your health, and UK data protection law gives you a right to a copy of the personal data an organisation holds about you. That includes records from an NHS mental health trust, your GP, a hospital, a private psychiatrist or psychologist, and a counselling or therapy service.

The longer answer is that health records are one of the few areas where UK law lets a provider hold something back on the grounds that seeing it could seriously harm you or someone else. This guide explains when that can happen, who has to make that call, and what you can do if you are refused. It was checked against the legislation in November 2026. It is general information, not legal advice.

The short version

You can ask. The right of access applies to NHS and private providers alike, in England, Scotland, Wales and Northern Ireland. The request is called a subject access request.
Timing: they must respond within one month. They can extend that by up to two more months only if your requests are complex or numerous, and they must tell you why within the first month.
Cost: it is free. A fee is allowed only if a request is manifestly unfounded or excessive, or for further copies.
Limits: information can be withheld if giving it to you would be likely to cause serious harm to your physical or mental health, or someone else’s. If the organisation is not itself a health professional, it can rely on this only with the opinion of the appropriate health professional. Information about other people can also be held back.
If you are refused: they must tell you why. Complain to them first, then to the ICO, the UK’s data protection regulator.

What the law says

The right of access is Article 15 of the UK GDPR. It covers all the personal data a provider holds about you, and it applies to everyone who holds your records: an NHS trust, a GP practice, a private clinic, a charity, or a therapist working on their own. The timing rules are in Articles 12 and 12A, as amended by the Data (Use and Access) Act 2025. Our guide to getting your medical records in the UK covers the request process in general.

UK law has no separate category for a psychiatrist’s or therapist’s session notes. If you have read American content about “psychotherapy notes”, that is a rule under HIPAA, a United States law, and it does not apply in the UK. Here, session notes are health data like the rest of your record. The rules written specifically for health data are in Schedule 3, Part 2 of the Data Protection Act 2018, and the main one is the serious harm test below.

When something can be held back, and who decides

This is the part that matters most for mental health records.

The serious harm test. The law describes it as being met where giving you access “would be likely to cause serious harm to the physical or mental health of the data subject or another individual” (Schedule 3, paragraph 2(2)). The right of access does not apply “to the extent that” the test is met (paragraph 5(1)). That wording matters: only the part that meets the test can be withheld, not your whole file.
A health professional has to make the call. If the organisation holding your records is not itself a health professional, as an NHS trust or a counselling charity is not, it can rely on the serious harm test only if it has an opinion from the appropriate health professional that the test is met (paragraph 5(2)). The appropriate health professional is usually the one “currently or was most recently responsible for the diagnosis, care or treatment” of you (paragraph 2(1)).
The opinion must be recent. It must have been obtained within the last six months, and even then it cannot be used if it would be reasonable to consult again (paragraph 5(3)).
Why a request can take time. The same rule works the other way too. An organisation that is not a health professional must not release health data in answer to a subject access request until it has an opinion from the appropriate health professional that the serious harm test is not met (paragraph 6(1)). This is why a trust’s records team may need a clinician to review your file before sending it. The one-month deadline still applies.
Things you have already seen. That clinical review is not needed for information the organisation is satisfied you have already seen or know about (paragraph 6(2)).

Information about other people

Mental health records often include what relatives, partners or friends told a clinician. A provider does not have to give you information that would identify another person, unless that person agrees or it is reasonable to give it to you without their agreement (Data Protection Act 2018, Schedule 2, paragraph 16). In deciding what is reasonable, the provider must consider things like any duty of confidence owed to that person and whether they have refused consent.

There is an important exception. Your doctors, nurses, psychologists and other health professionals are not “other people” in this sense. Where the information is in a health record and the other person is a health professional who wrote or contributed to it, or was involved in your care, giving it to you is treated as reasonable (Schedule 2, paragraph 17). So a provider cannot hold back an entry just because it names the clinician who wrote it.

How to ask

Ask each place that treated you. Your GP practice, each NHS trust or health board, a private hospital, and a private psychiatrist, psychologist or therapist each keep their own records. In the NHS, requests usually go to the trust’s medical records, information governance or data protection team.
Ask in writing if you can. A verbal request is valid, but an email or letter gives you a dated record. You do not have to use the words “subject access request” or the provider’s form.
Be specific. Say what you want, such as “all my records from the community mental health team”, or “my psychology notes and reports from 2023 to 2025”. If they hold a lot, they can pause the clock to ask you to narrow it down.
Ask for an electronic copy. If you ask by email, they should give you the information in a commonly used electronic form (UK GDPR, Article 15(3)). If you would rather go through the records with your clinician, you can ask for that too.
Keep a copy of your request and note the date you sent it.

If you are refused, or nobody answers

Complain to the provider first, in writing. Every organisation must have a way to handle data protection complaints, and must acknowledge yours within 30 days (Data Protection Act 2018, section 164A). If something was withheld, ask which parts, on what ground, and whether the appropriate health professional was consulted.
Then go to the regulator. If that does not resolve it, complain to the ICO at ico.org.uk (section 165). Since 30 September 2026 the regulator is formally the Information Commission.

What about the NHS App?

In England, GP practices have had to give patients online access to new entries in their GP record, as they are added, since 31 October 2023, through the NHS App and other approved apps. Information the practice would not have to give you under a subject access request is excluded from that online access (National Health Service (General Medical Services Contracts) Regulations 2015, regulation 71ZA). In practice, that means a GP can hide an entry from the app on the same serious harm and third-party grounds described above.

The app shows your GP record only. Notes from a mental health trust, a hospital stay, or private therapy are usually not there, and older GP entries may not be either. For those, make a subject access request. The NHS App is for people registered with a GP in England; Scotland, Wales and Northern Ireland have their own arrangements, but the subject access route is the same across the UK.

Common situations

A parent asking for a child’s records. When a parent asks on a child’s behalf, information the child gave in the expectation that it would not be passed on, or has said should not be passed on, can be held back (Data Protection Act 2018, Schedule 3, paragraph 4).
Someone who has died. Data protection law covers living people only. A deceased person’s records come under the Access to Health Records Act 1990 in England, Wales and Scotland, and the Access to Health Records (Northern Ireland) Order 1993. Our UK medical records guide explains who can apply.

A word on reading your own records

Clinical notes are written for clinicians. They can use blunt language, shorthand and diagnostic labels that read very differently on the page than they did in the room. Some people find that confronting. It can help to read them with someone you trust, or to ask your clinician to go through them with you. If reading them brings up something difficult, Samaritans is available free on 116 123, at any time.

If you think something in your records is inaccurate, you can also ask for it to be corrected (UK GDPR, Article 16).

Where exora fits

Once you have your records, you can upload them to exora along with the rest of your health documents. exora reads them and organises the conditions, medicines and history into one record you control, with every detail linked back to the page it came from. You choose what to upload and who, if anyone, it is shared with. How exora handles your information is set out in our privacy policy. exora is free to start, with an optional membership.

exora does not connect to the NHS or to your therapist’s systems. It works with the documents you request and decide to add.