Subject Access Request (SAR)

To support efficient and secure processing, we outsource our SARs administration to Medi2Data, an NHS-approved provider.

Once your request and ID have been validated, Medi2Data will securely process your information on our behalf, in line with UK data protection laws (UK GDPR and the Data Protection Act 2018).

We will process your request within 28 days of receipt of your validated application.

You will appreciate that health data relating to any individual is highly confidential and the Practice must ensure that it releases such data only to the person to whom it relates, or to a person authorised to act on his or her behalf. If you require to see any health data, please complete this online Request Form as fully and accurately as possible to enable us to locate the exact information you require.

The General Data Protection Regulations (GDPR) gives you the statutory right of access to any information, manual (paper) or computerised. You may wish to authorise someone else to make your application on your behalf and if you have parental responsibilities you may make an application to see your child’s notes, if they are under the age of twelve years.

You do not have to give a reason for applying for access to your General Practice records. If you do not need access to your entire records, it would be helpful if you would inform us of the periods and area of your health records that you require, along with details which you feel may have relevance (e.g. clinic type, location, dates).

Timescale

The Practice will deal with your request as quickly as possible. If you request copies of all or part of your medical record, these will be ready within the allocated timescales specified by the Regulations (which is currently 28 days from receipt of your accurately completed form and confirmation of consent), and we will telephone you when they are available for you to come to the Practice to collect them. Under certain circumstances, this period can be extended to 3 months but we will keep you informed of the progress of your request during this extended period.

Fees

We will not make a charge for the first request for access to your medical records. We may, however, charge for subsequent requests or if we deem that the volume of information requested is excessive. You have the right to simply view your records (i.e. not receive a copy in a permanent form); information on how to arrange this is detailed below.

Type of request

If you request to see the original records, you will be invited to make an appointment at a mutually convenient time to view them. If you request copies, these will be ready within the allocated timescales specified by the Regulations, and we will telephone you when they are available for you to come to the Practice to collect them.

Proof of identity

Two forms of identity must be provided (one of which must be photographic). This is to ensure information is not released to unauthorised individuals.

The table below outlines the proof of identity we can accept.
Type Of Application	Identification Required
Patient applying for their own Can be waived if the applicant is known to the Staff Member accepting the request	One which must be photographic i.e. passport. One containing individuals name and address
Third Party Applying. Consent of Patient will be required BEFORE the request will be processed	One containing Third Party name and address One must be Photographic ID of Third Party
Applying on behalf of a child We will ALWAYS obtain consent for release of records from a child age 12+ to	One which must be Child’s birth certificate Photographic ID of person with parental rights

If you are completing this application on behalf of another person, the Practice will require their authorisation before we can release the data to you. The person whose information is being requested should sign the relevant section within the online form. If the patient is a child (i.e. under 16 years of age) the application may be made by someone with parental responsibilities – in most cases this means a parent or guardian. If the child is capable of understanding the nature of the application, his or her consent should be obtained or, alternatively, the child may submit an application on their own behalf. Children will, generally, be presumed to understand the nature of the application if aged between 13 and 16 however, all cases will be considered individually.

Patient Details

Full Name

Previous Names (if any)

Address

Date of birth Please use format day/month/year e.g. 12/12/1952

NHS Number (if known)

Mobile Number

Email Address

Request Confirmation

I request access to the information held in my medical records.

I understand this information may include sensitive records (e.g., mental health, sexual health).

I understand that records including information about other individuals may be redacted to protect their privacy.

Records Requested

Full Medical Record

Records from a specific date range:

Provide the from and to dates here

Other (please specify):

Preferred Delivery Method

Identification

To verify your identity, you will need to provide two forms of ID:

Photographic ID (passport, driving licence, etc.)

Proof of Address (utility bill or bank statement dated within last 3 months)

Processing cannot begin until valid ID has been presented in person at reception and verified.

Repeated or Excessive Requests

Patients are entitled to make multiple SARs. However, if requests are frequent, repetitive, or manifestly excessive, the practice may:

Charge a reasonable fee for additional requests, or

Refuse to comply with the request, in line with GDPR Article 12(5).

Each request will be considered individually, and you will be notified if a request is deemed excessive.

Data Handling

To ensure secure processing, your SAR may be handled by Medi2Data, an NHS-approved provider. Your records will be compiled and delivered in line with UK GDPR and the Data Protection Act 2018, maintaining confidentiality at all times.

No fee will be charged for a standard request unless it is manifestly unfounded or excessive, in accordance with GDPR.

Timeframe

Your request will be processed within 28 days of receipt of your validated application. In complex cases, this may be extended by up to 2 additional months, with notice.

Declaration

I confirm that the information I have provided is accurate.

I understand and consent to the handling of my personal and sensitive data as described above.

Your name

Date form completed

Privacy Protection

Information submitted through secure forms is used only for the purposes of processing your request. We may be in touch with you in relation to the information submitted.

All Information submitted through secure forms is secured with a private key and is accessed over a secure connection by nominated staff. We have a strict confidentiality policy.

This information is not shared with any third party organisations.

This information is retained for up to 28 days.

I consent to my information being used for the purposes described above and wish to submit this online form to Springfields Medical Centre • Legh Street, Warrington, WA1 1UG.

Learn more about our Privacy Policy and Terms of Use. Should you have any concerns about sending your personal details using the web, please use one of the alternative methods offered by our organisation.