Under the General Data Protection Regulation (GDPR), individuals have the right to obtain:
confirmation that their data is being processed
access to their personal data (and only theirs)
other supplementary information – this largely corresponds to the information that should be provided in a privacy notice
https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation- gdpr/individual-rights/right-of-access/
The GDPR clarifies that the reason for allowing individuals to access their personal data is so that they are aware of and can verify the lawfulness of the processing and understand how and why the practice is using their data.
An application for access to health records may be made in any of the circumstances explained below. This policy does not apply to requests to access records of deceased patients, as the GDPR does not apply to the data of deceased patients. To review our full policy please read Practice Subject Access Request Policy