Ever wondered what happens to the information your GP or hospital collects about you? Here’s what you need to know to manage your NHS health data, keep your information private, and access your records when you need them.
What counts as your NHS health data?
Your health data is any information your GP surgery or other NHS services record about you, such as the; .
- Medicines you’ve been prescribed
- Allergies
- Vaccinations
- Diagnoses
- Appointment notes
- Test results
- Letters from hospital or specialists sent to your GP are included too.
It is important to note here that your record usually won’t contain information kept by other providers (like dentists, opticians, or hospitals), unless they’ve sent details to your GP. To get those, you’ll need to contact each service separately (NHS — View your GP Health Record).
Who owns your NHS health data?
You are the subject of your health record and have rights over it, but the NHS is what’s known as the “data controller.” That means they’re responsible for keeping your information safe and only using it for care or lawful reasons.
The NHS doesn’t “own” your data – instead, it holds and protects it for your benefit, following UK law (NHS Constitution, GDPR/Data Protection Act 2018).
Can other organisations see your data?
Your health information gets shared only when needed. For your direct care, NHS teams use your information to treat and look after you. Sometimes, information is used for planning NHS services or research, but there are strict rules: it must be anonymised unless you give your explicit permission, or the law requires sharing (for example, during a public health emergency) (NHS Your Data Matters).
It’s never sold to marketers or insurers.
How to opt out of data sharing
You have choices if you don’t want your data used beyond your own care:
- Type 1 Opt-Out: Stops your GP records leaving your surgery for research and planning. You’ll need to fill in a form or contact your GP directly. Note that this only covers data held by your GP practice.
- National Data Opt-Out: Lets you stop NHS England and other organisations using your confidential patient info for research or planning (except where there’s a legal or public health need). You can set this by visiting NHS Your Data Matters, using the NHS App, or calling 0300 303 5678. You can change your mind at any time.
For more on both opt-out choices, visit NHS Digital’s guide.
How you can see your own NHS data
It’s your right to see what’s in your health record. The easiest way is through the NHS App or via the NHS online account. After showing proof of who you are, you’ll see the latest information your GP has added.
If you want older or more detailed info, simply contact your GP surgery; you might need to ask a receptionist or submit a written request (NHS — View your GP Health Record).
If you’d prefer, you can still request a paper or digital copy of your full records. This is called a “subject access request” (SAR), and your GP or NHS provider must respond (normally within 28 days).
You can also use other approved apps or portals, your GP surgery can advise what’s available locally (NHS SAR guidance).
Your key rights at a glance
| What you can do | How | Read more |
| View GP health record | NHS App or contact your surgery | nhs.uk/view-your-gp-health-record |
| Opt out of data sharing (National Opt-Out) | NHS website, phone, or in writing | nhs.uk/your-nhs-data-matters |
| Get historical records (SAR) | Written request to your GP or hospital | nhsbsa.nhs.uk/requesting-medical-records |
| Find out more about your NHS rights | NHS Constitution | gov.uk/nhs-constitution |
Need help?
You can always ask your GP surgery for advice on your data rights, or visit NHS Your Data Matters for step-by-step guides and contact details for further questions.
This guide is provided by My Patient Advice, using official NHS and Government sources to keep you informed and empowered.
Private ADHD Assessment
Book an Assessment as early as this week* – Full Report included
Frequently Asked Questions
What rights do I have under GDPR regarding my NHS health data?
Under the UK GDPR and Data Protection Act 2018, you have key patient rights:
– Access: You can request a copy of your records through a Subject Access Request (SAR). NHS organisations must respond within 30 days (ICO, 2024).
– Correction (Rectification): Ask for incorrect information to be fixed (Lewisham & Greenwich NHS Trust, 2025).
– Erasure (“Right to be forgotten”): You may request deletion, though medical records may be kept when required for care or legal reasons.
– Restriction & Objection: You can limit or object to how your data is used.
– Withdraw Consent: You may revoke consent for non‑care uses at any time.
If you feel your rights are breached, you can complain to your NHS provider or the Information Commissioner’s Office (ICO).
What is NHS national data opt‑out (and Type 1 GP opt‑out)?
– Type 1 opt‑out: Registered at your GP surgery – prevents your identifiable data being shared outside the practice for non‑care purposes.
National data opt‑out: Covers sharing by the NHS and other health bodies for research and planning. You can set it through Your NHS Data Matters.
Type 1 stops local data flows between your GP and NHS England; national opt‑out applies further upstream (NHS, 2024; Northgate Medical Centre, 2023).
Can I choose which research projects my data contributes to?
Not yet. The NHS National Data Opt‑Out gives one overall choice, allowing or refusing your confidential data to be used for research or health planning. You can set or change this preference anytime through Your NHS Data Matters .
At the moment, you can’t pick specific projects, though the NHS is considering future options for more granular control.
If you take part in a particular trial, that separate consent covers how your data is used for that study.
