Your NHS Health Data: What's Being Shared, With Whom, and How to Opt Out

Most people have a vague awareness that their NHS health data is used for purposes beyond their direct care. What they typically do not know is the scale of what is being shared, who can access it, how it is changing, and what they can do if they would prefer it were not shared at all.

The debate around NHS patient data has intensified significantly in 2025 and 2026 — driven by three overlapping developments. The government's plan to create a Single Patient Record consolidating all health data into one system accessible via the NHS app. The referral of NHS England to the Information Commissioner's Office over the use of pandemic patient data to train an AI model without patient consent. And the ongoing controversy around the General Practice Data for Planning and Research programme — the collection of GP records from 55 million patients for use by researchers and, in some cases, commercial organisations.

This article does not take a position on whether these developments are right or wrong. It explains what is happening, what the evidence shows about how data is used, and what your options are if you want to understand or control how your health information is shared.

TL;DR

• The government is planning to create a Single Patient Record, accessible via the NHS app by 2028, through which the NHS will aggregate all of a patient's health data into a single controlled record.
• In June 2025, doctors referred NHS England to the Information Commissioner's Office over concerns that patient data gathered during the COVID-19 pandemic was being used to train the AI model Foresight without patient consent. As of March 2026, the BMA is considering collective action around patient data sharing.
• The GPDPR programme moves GP records from 55 million patients into a centralised database. NHS England says it never sells patient data or shares it with insurance or marketing companies.
• There are two separate opt-out mechanisms — the Type 1 Opt-out (GP level) and the National Data Opt-out (NHS England level). You must use at least two different processes to fully opt out.

There is no deadline for opting out. You can make or change your choice at any time.

Your individual medical care is not affected by opting out of data sharing for research and planning purposes.

What the NHS Does With Your Data

The NHS uses information about patients to research, plan and improve its services. It gets this data from GP surgeries, hospitals and other healthcare providers. The organisation that collects your data is called NHS England. To help improve services, NHS England shares this data with researchers from organisations such as universities or hospitals.

This data sharing has happened in various forms for decades — and has produced genuine medical benefits. The COVID-19 vaccine programme was accelerated significantly by NHS data infrastructure. The understanding of long-term health conditions at population level depends on access to aggregated patient data. Medical research that improves treatment for millions of people is routinely conducted using anonymised NHS records.

The current controversy is not primarily about whether this data sharing produces benefits — it does. It is about consent, transparency, and the expanding scope of who can access data and for what purpose.

The Three Key Developments in 2025 and 2026

1. The Single Patient Record

The government envisages creating a Single Patient Record, accessible via the NHS app by 2028, through which the NHS will aggregate all of a patient's health data into a single controlled record. Patients will be able to read, share, and update their own care plans in-app, and it will allow doctors to access a person's medical history across different locations.

The stated benefits are significant — joined-up care across different NHS providers, reduced duplication of tests and referrals, better management of long-term conditions, and improved emergency care when a patient's full history is available. The concern from privacy campaigners is that consolidating all health data into a single accessible record expands the potential impact of any data breach or misuse — and that the governance around who can access the Single Patient Record and for what purposes is not yet clearly defined.

The government is also planning to offer genome sequencing at birth to all parents, with a view to turning the NHS from a disease-curing, damage-response service into a preventative one. This genomic data — among the most personally identifying and sensitive biological information that exists — raises its own set of consent and data governance questions that are only beginning to be addressed in policy.

2. The Foresight AI Controversy

In June 2025, doctors referred NHS England to the Information Commissioner's Office over concerns that patient data gathered during the COVID-19 pandemic was being used to train the AI model Foresight without patient consent.

Foresight is an AI model developed to predict patient deterioration and health outcomes. The concern was not that the model was being developed — it was that the patient data used to train it had been collected during the pandemic for a specific purpose (managing COVID-19), and using it to train an AI model for different purposes without explicit patient consent potentially breached the terms under which it was collected and the patients' reasonable expectations of how it would be used.

As of March 24, 2026, the British Medical Association is considering collective action around patient data sharing — a significant escalation from a professional body that has historically supported NHS data programmes when conducted with appropriate transparency and consent.

The ICO referral is ongoing. The outcome will have significant implications for how NHS England can use historically collected patient data for AI development — a rapidly expanding area of NHS investment.

3. The GPDPR Programme

NHS England is moving the records of 55 million patients into a database that will be accessible by third-party companies — a move that privacy campaigners claim could be unlawful.

The General Practice Data for Planning and Research programme — GPDPR — collects GP records including diagnoses, symptoms, test results, medications, allergies, referrals, and appointments. The data is pseudonymised — names and direct identifiers are removed — but privacy experts note that pseudonymised data can sometimes be re-identified when combined with other datasets.

NHS England states that it never sells patient data or shares it with insurance or marketing companies, and that all data shared is protected by strict rules around privacy, confidentiality and security.

The debate centres on the phrase "third-party organisations." Researchers from universities and hospitals with legitimate research purposes are the primary intended users. But the category of organisations that can apply for access to the secure data environment is broader than this, and campaigners argue the governance framework does not provide sufficient transparency about which organisations are accessing data and for what purposes.

The Opt-Out System: What Your Options Are

If you want to limit how your NHS health data is used beyond your direct care, there are two separate mechanisms — and you need to use both to fully opt out. While in 2014 you could opt out of secondary uses of NHS data with a single form, now you must use at least two different processes — three, if you have children or dependants.

Type 1 Opt-Out (GP level)

The Type 1 Opt-out prevents your GP records from being extracted and sent to NHS England for secondary uses — research, planning, and analysis outside your direct care.

If you do not want your patient data shared with NHS Digital, you can register a Type 1 Opt-out with your GP surgery. You can register a Type 1 Opt-out at any time. You can also change your mind at any time and withdraw a Type 1 Opt-out.

To register a Type 1 Opt-out: contact your GP surgery and ask for the Type 1 Opt-out form. Complete and return it. Your surgery will process this and it will prevent your GP records from being extracted for secondary uses going forward.

Important caveat: if you register a Type 1 Opt-out after your patient data has already been shared with NHS Digital, no more of your data will be shared from this date. NHS Digital will however still hold the patient data which was shared before you registered the opt-out.

National Data Opt-Out (NHS England level)

The National Data Opt-out prevents NHS England from sharing your confidential patient information — from any source, including hospitals — with other organisations for purposes beyond your direct care.

There is no deadline for opting out of sharing your confidential patient information for research and planning. You can make or change your choice at any time.

To register a National Data Opt-out, you have two options:

Online: Visit https://www.nhs.uk/your-nhs-data-matters and make your choice through the NHS website. You will need to log in with your NHS login or create one.

By phone: If you don't have internet access, you can phone NHS Digital on 0300 303 5678.

The National Data Opt-out cannot be processed by your GP surgery — it must be done directly through NHS England.

What Opt-Out Does and Does Not Cover

Opting out prevents your data being used for research and planning beyond your direct care. It does not affect how healthcare professionals access your records when treating you — your GP, hospital doctors, and other care providers will still be able to access the information they need to treat you safely.

Your individual care will not be affected if you opt-out using either option.

Opting out also does not remove data that has already been shared — it prevents future sharing from the point of registration. If you are concerned about data already held by NHS England, the National Data Opt-out prevents that data being further shared with third parties for secondary purposes.

What the NHS Says — and What the Critics Say

This is a genuinely contested area and it is worth presenting both positions honestly.

The NHS position: The NHS uses information about patients to research, plan and improve services. All data that is collected and shared is protected by strict rules around privacy, confidentiality and security. NHS England never sells patient data or shares it with insurance or marketing companies. The benefits of health data sharing — accelerating medical research, improving population health management, enabling better emergency care — are real and significant.

The critics' position: Campaigners claim the move to centralise patient records could be unlawful and that the opt-out process has not been communicated effectively to patients. Privacy experts note that pseudonymised data is not always fully anonymised, that the governance around third-party access needs greater transparency, and that patients have not been directly informed of the changes to how their data is being used. The Foresight AI referral to the ICO reflects genuine professional concern about consent standards.

Both positions have merit. The NHS's health data infrastructure has produced genuine medical benefits and its stated safeguards are real. The concerns about transparency, consent, and the expanding scope of data use are also legitimate and are being taken seriously by professional bodies and regulators.

Frequently Asked Questions

Does the NHS sell my health data?

NHS England states that it never sells patient data or shares it with insurance or marketing companies. Third-party organisations — primarily researchers from universities and hospitals — can apply to access pseudonymised data through a secure data environment for approved research and planning purposes.

Who can access my NHS health data?

NHS England shares pseudonymised data with researchers and organisations for health planning and research purposes. To help improve services, NHS England shares data with researchers from organisations such as universities or hospitals. The category of organisations that can apply for access is broader than just universities, which is a focus of the current debate.

How do I opt out of NHS data sharing?

You need to use two separate mechanisms. First, contact your GP surgery to register a Type 1 Opt-out — this prevents your GP records being extracted for secondary purposes. Second, register a National Data Opt-out online at www.nhs.uk/your-nhs-data-matters or by calling 0300 303 5678 — this prevents NHS England sharing any confidential patient information with other organisations for purposes beyond your care. There is no deadline — you can make or change your choice at any time.

Will opting out affect my medical care?

No. Your individual care will not be affected if you opt-out. The opt-out applies only to secondary uses — research and planning — not to the data that healthcare professionals use to treat you directly.

What is the Foresight controversy about?

In June 2025, doctors referred NHS England to the Information Commissioner's Office over concerns that patient data gathered during the COVID-19 pandemic was being used to train the AI model Foresight without patient consent. The concern was that data collected for a specific purpose was being used for a different purpose — AI model training — without the explicit consent of the patients whose data was used. The ICO investigation is ongoing.

What is the Single Patient Record?

The government is planning to create a Single Patient Record, accessible via the NHS app by 2028, through which the NHS will aggregate all of a patient's health data into a single controlled record. Patients will be able to read, share, and update their own care plans in the app, and it will allow doctors to access a person's medical history across different locations. Privacy campaigners have raised concerns about the governance framework around who can access this consolidated record and for what purposes.

The Bottom Line

NHS health data sharing is a genuinely complex issue that sits at the intersection of significant public benefit and legitimate privacy concerns. The research and planning uses of NHS data have produced real medical advances. The concerns about transparency, consent, and the expanding scope of data use — reflected in the BMA's consideration of collective action and the ICO referral over Foresight — are not unreasonable.

The most important practical message is straightforward: you have choices, they are accessible, there is no deadline, and exercising them does not affect your medical care. If you want to understand and control how your health data is used beyond your direct care, the two opt-out mechanisms — Type 1 Opt-out via your GP and National Data Opt-out via the NHS website or phone — are available to you now.

Whether to use them is a personal decision that depends on your own assessment of the balance between the collective benefits of health data sharing and your individual privacy preferences. This article aims to give you the information to make that decision — not to make it for you.

Related reading: AI, Anxiety and the Future of Calm · Why Therapy Works: The Neuroscience of Talking and How Digital Support Is Changing Everything · Micro-Anxiety: The Tiny Stressors That Are Quietly Draining Your Mental Health

Popular Articles