Access to Medical Records

Rights of Access

In accordance with the Data Protection Act 2018, GDPR General Data Protection Regulation 2016 and the Access to Medical Records Act, patients can request to see copies of their medical records. Requests can be made to any part of the practice but should be directed via the reception team.

You can request copies, verbally, via email or over the phone. There is no charge to you to request copies of your records. However, there are some instances where we can, please see the ICO page for further information. Your right of access | ICO

In accordance with the General Data Protection Regulation therefore, patients (data subjects) have the right to access their data and any supplementary information held by Whiteladies Medical Group. Data subjects have a right to receive:

  • Confirmation that their data is being processed
  • Access to their personal data
  • Access to any other supplementary information held about them

Access to Medical Records

How to Access Your Medical Records

Please note: you do not need to complete an access to records application to view your Covid Vaccine Passport, this information is available to all patients with an active online account.

Please use the online form below to request any of the following:

  • Detailed online access (access to medical record information)
  • Proxy access
  • Paper copies of your medical record

Please see this page for more information about online access.

Access to Medical Records Application 


Health Record - Who May Apply for Access

Patients with Capacity

Patients with capacity have a right to access their own health records via Online Access (electronic records) or SAR (paper copy of full records). Patients may also authorise a third party such as a solicitor to do so on their behalf. Competent young people may also seek access to their own records. It is not necessary for patients to give reasons as to why they wish to access their records.

Children and Young People Under 16

Where a child is competent, they are entitled to make or consent to a SAR to access their record. Patients aged 16 and under cannot apply for Online Access. Parents/guardians please see Proxy Access for details on how to access under 16s medical information.

Children aged over 16 years are presumed to be competent. Children under 16 must demonstrate that they have sufficient understanding of what is proposed in order to be entitled to make or consent to an SAR. However, children who are aged 12 or over are generally expected to have the competence to give or withhold their consent to the release of information from their health records. When assessing a child’s competence, the responsible GP/Governance Lead will explain the issues in a way that is suitable for their age. Where in the view of the appropriate health professional, a child lacks competency to understand the nature of his or her SAR application, the holder of the record is entitled to refuse to comply with the SAR.

Next of Kin

A next of kin cannot give or withhold their consent to the sharing of information on a patient’s behalf. As next of kin they have no rights of access to medical records. For parental rights of access, see the information above.


A patient can authorise a solicitor acting on their behalf to make a SAR. A solicitor must provide the patient’s written consent to the Practice along with the request.


Detailed Online Access to Medical Records

Online Access can only be granted to patients aged 16 years and over, no third parties.

Through online access to your medical records patients can access an up to date version of parts of their electronic GP medical record including information about medication, allergies, vaccinations, previous illnesses and test results.

You can also use your online access account to book appointments and order repeat prescriptions.

Proxy Online Access

Proxy access enables a user who is not the patient to register for an online account to access the designated patient’s medical record. The patient can specify what information the proxy user can access, for example the proxy user could be restricted to just booking appointments or requesting repeat medications, without any access to the patient’s medical record.

Proxy users not registered at this practice: A proxy user must be registered at the same surgery as the patient in order to synchronise the proxy user’s record to their existing online access account. If the proxy applicant is not registered at the same surgery as the patient they will need to create a separate online access account for proxy access and cannot register the same email address to that of any existing online access account active at another surgery.

Proxy access via a patient representative (e.g. parent/guardian) can be enabled for under 16s. Proxy access will be revoked once the patient reaches the age of 16, at which point the patient can then re-apply for their own access.


Time frame

Once the relevant application form is submitted to the Practice, we aim to process the request within 28 days. The maximum time for processing a request is one calendar month. The Practice will contact the applicant if there are any queries and when the application is complete.



There may be occasions when the data controller (Whiteladies Medical Group) will withhold information kept in the health record, particularly if the disclosure of such information is likely to cause undue stress or harm to you or any other person.


Data Controller

We, at the Whiteladies Medical Group (‘the Surgery’) situated at Whatley Road, Clifton, Bristol, BS8 2PU, are a Data Controller of your information. This means we are responsible for collecting, storing and handling your personal and healthcare information when you register with us as a patient.


Data Protection Officer

The surgery’s Data Protection Officer is:

Kelly-Anne Gast
Avon Local Medical Committee,
14a High Street, Staple Hill,
Bristol, BS16 5HP
Tel: 0117 9702755