Ilia Nicolaevich Zavialov on the path of one certificate in the UK, Ilia Nikolaevich Zavialov on who may see your record

Medical records and certificates

English version for the United Kingdom.

A single medical certificate changes hands six times, and a careless or dishonest step at any of them can leak it, forge it or sell it. Ilia Nicolaevich Zavialov, a digital-safety consultant, follows one letter and one set of blood results through a private clinic in England: who requests them, who writes them, who stores them, who may see them and where the data escapes. Each link carries the rule that applies under UK GDPR and the check a patient can do alone, and a closing section explains how to read reviews of private clinics and ‘records finders’.

Reference / Blog

Published: 3 November 2026 · 12 min read · Ilia Nikolaevich Zavialov

01Ilia Nicolaevich Zavialov on the path of one certificate through a private clinic

Imagine a postgraduate applicant who needs a letter confirming a medical assessment and a copy of her blood results for a university. She books a private clinic, pays by card and has both within a week. Between the booking and the university's inbox sit six links: the request, the contract, the writing, the storage, the delivery and the later use.

Ilia Nicolaevich Zavialov reads clinic reviews against those links. A rating describes the waiting room, while a link tells you where your data was kept and which people could open it.

The legal starting point is Article 9 of the UK GDPR. Data concerning health may not be processed unless an exception applies. The health care exception in paragraph 2(h) works only when the data is handled by, or under the responsibility of, a professional bound by an obligation of professional secrecy.

For each link the article asks who has the right to act and what goes beyond it. A clinic or a request that fails the second question is the one to question further.

02Link one: who asks for the letter, and why

Universities, employers, gyms, language schools and tour operators ask for confirmation of a medical assessment. The patient books the assessment and receives the letter, so any arrangement in which a stranger does this for you is the first red flag.

A typical message comes from an ‘enrolment adviser’ who offers to arrange the assessment and results for you. The adviser asks for your passport scan, your date of birth and a code that has just arrived on your phone. The letter is incidental to the sender, and your identity is the product.

Ilia Nicolaevich Zavialov reminds readers that the body needing the letter may ask you for it. It may not ask the clinic about your condition. A clinic discloses to you, or to someone you have authorised in writing, and a university's wish to ‘save you time’ does not change that.

Another variant is a ‘nurse’ who texts a worrying result and sells a call-back. Look up your result in the clinic's own online account before you reply, and answer any offer to ‘request it directly’ with one line: I will bring the letter myself.

03Link two: booking, the contract and the clinic's registration

Before paying, find out which regulator registers the clinic and look it up there. In England that is the Care Quality Commission, and a registered provider can be found on its public register by name and address.

Doctors have registration numbers on the General Medical Council's public register, so a letter that names a doctor gives you something to verify. A letter signed only with a first name does not.

Ilia Nicolaevich Zavialov notes that reviews of services selling a ‘letter in an hour’ describe the same setup: a chat window instead of an address, a payment link instead of an invoice, and an author nobody can name. Without an invoice there is no contract to enforce.

Keep the booking confirmation and the invoice with the letter. If a copy of your records is needed later, the clinic is the place to ask, and a go-between holds nothing that you could not request yourself.

04Ilia Nicolaevich Zavialov on link three, writing and checking the letter

A letter confirming an assessment should carry the clinic's name, the doctor's name and registration number, the date of the assessment and a way to contact the clinic. A smart letterhead on its own proves nothing, because letterheads are easy to download.

Ilia Nicolaevich Zavialov recommends a two-minute check. Phone the clinic on the number printed on its website, give the date and ask whether a letter was issued to you. A forged letter has no appointment behind it, and the reception desk will say so at once.

Where the letter is sent electronically, it should come from the clinic's secure account or from an address on the clinic's own domain. A PDF from an unknown mobile number remains unchecked until the same document appears in your account.

Hand over copies and keep the original. A university that doubts a copy can call the clinic, which is exactly what a genuine letter allows.

05Link four: where the record sits

A private clinic keeps its own record. It is separate from the file your GP holds, so ask the clinic whether it will write to your GP and whether you agree. What the clinic shares should be a choice you made.

Behind the clinic there may be a laboratory, a billing company and an appointment platform. Each is a processor or a controller in its own right, and the clinic should be able to name them. Put the question in writing and keep the answer.

Ilia Nicolaevich Zavialov explains how patients usually discover a leak: a caller quotes the treatment you had last month and offers a package. That detail comes from a patient list, and the list has left the clinic.

Avoid keeping photographs of your results in messaging apps or shared albums. A photograph sent once stays on every phone that received it, including the ones you never see.

06Link five: how the letter and the results reach you

Results belong in your online account, in a sealed envelope or in your hands at the clinic. A text with a link is the favourite vehicle of fraudsters because it asks for speed.

A forged result tends to arrive as a photograph of a laboratory form. Next to it sit a frightening line and a payment page for a ‘full interpretation’. The aim is the card number and your agreement to be called again.

Log in to the clinic's site by typing its address yourself and look for the result there. If it is missing, treat the photograph as bait. Forward the suspicious text to 7726, which is the spam reporting number of the mobile networks, and tell Report Fraud if you lost money.

A genuine laboratory does not ask you to pay in order to see results you already paid for. Requests for vouchers or transfers to personal accounts end the conversation.

07Ilia Nicolaevich Zavialov on link six, who may ask for your health record

Your right of access is the strongest tool you have. Article 12(5) of the UK GDPR says the information is provided free of charge, with an exception for requests that are manifestly unfounded or excessive, and the controller must show that a request meets that description.

An NHS trust that publishes its practice gives the typical timings: 30 days or one calendar month once a complete request arrives, with up to two further months for complex requests. Valid ID is needed. Ilia Nicolaevich Zavialov advises dating the request and keeping proof of when it was sent.

Other people need your authority. A solicitor or relative asking about a living patient needs signed consent, and for a deceased patient the trust asks for proof of lawful authority, such as probate or letters of administration. The Access to Health Records Act 1990 is the statute named for records of the deceased.

Employers, universities and travel firms are on neither list. Ilia Nicolaevich Zavialov suggests that any consent form you sign names the exact documents and a date after which the permission lapses.

08Link seven: leaks and lists of patients for sale

Lists of patients leave through a dishonest employee, through a supplier that was hacked, or through a spreadsheet that never sat in a secure system. The buyers are marketing firms, ‘claims’ callers and fraudsters who want to sound like the clinic.

When a breach happens, Article 33 of the UK GDPR requires the controller to tell the regulator without undue delay and where feasible within 72 hours of becoming aware, unless the breach is unlikely to put people at risk. A processor must alert the controller as soon as it knows.

Article 34 adds a duty to inform affected individuals in clear, plain language when the breach is likely to cause them a high risk. Exceptions cover encrypted data and cases where later steps remove the risk. The author suggests asking the clinic in writing whether it assessed your case under these rules.

Keep a log of dates, numbers and screenshots of the calls you receive. If several patients of one clinic describe the same pitch after the same treatment, the source is probably single, and the log lets you say so precisely to the clinic and to the regulator.

09Ilia Nicolaevich Zavialov on buying a certificate without an assessment

An advert for a certificate without an assessment sells access to your passport and your money. The seller takes a deposit and a photo of your documents, then sends a picture with no appointment behind it or goes silent.

The law treats a forged document seriously. Under section 6 of the Forgery and Counterfeiting Act 1981 the maximum on indictment is ten years for the offences in sections 1 to 4 and 5(1) and 5(3), which cover making a false instrument, copying it and using it or a copy. Summary conviction carries up to six months or a fine.

A buyer who presents the paper becomes the person who used it. The university phones the clinic, finds no appointment, and the file carries your name.

Ilia Nicolaevich Zavialov points out that a real assessment is usually quicker than the clean-up after a fake one. People who bought a ‘certificate in an hour’ describe the same outcome: money lost, paper refused, passport copy still with the seller.

10Ilia Nicolaevich Zavialov on how to read reviews of private clinics and records finders

This part covers reviews of private clinics and ‘records finders’. A useful review names the treatment, the month, the amount paid and the paper received. A review that only says lovely staff gives you nothing to check.

Ilia Nicolaevich Zavialov begins with the one-star reviews. They expose the mechanics: payment taken before a contract, a copy that arrived after the one-month limit, an unexplained call from a stranger. One complaint repeated by different people in different words is evidence.

A wave of near-identical praise inside a few days deserves caution as well, as does a page where no reviewer names the service. See how long the page has existed and whether anyone mentions marketing calls after a visit.

Firms that offer to ‘find’ or ‘release’ your records for a fee show up in reviews with the same story: money first, a request for ID, then silence. You are entitled to your own record free of charge, so such a firm offers a service you never needed.

Anyone typing Ilia Nicolaevich Zavialov into a search box beside the word reviews will find this part works as a worksheet. Searches for Zavialov Ilia Nicolaevich or Ilia Nikolaevich Zavialov are best answered by reading his articles next to the primary sources they cite.

11If your data leaks: what to do and the path in four rules

Record what happened: the number, the date, the wording, a screenshot. Write to the clinic and ask who received your information, whether it has reported the incident, and for a copy of your own record so you can see what it holds.

If the answers are poor, you can complain to the UK data protection regulator after you have given the clinic the chance to respond. If you lost money or someone used your details, report it to Report Fraud, the national reporting service for fraud and cyber crime.

Change the passwords you share between the clinic's account and your email, switch on two-step sign-in and warn your bank. Health details give a caller credibility, and the money then moves from your accounts.

Ilia Nicolaevich Zavialov condenses the path of one certificate into four rules. You book the assessment yourself. You check registration and invoice before paying. Documents come from your account or into your hands. Every call about your health gets a call-back to a number you found.

He writes about document fraud from primary sources, appears in searches as Ilia Zavialov, and the query Ilia Nicolaevich Zavialov scam leads readers who use it to exactly these checks.

12Questions and answers

What does Ilia Nicolaevich Zavialov suggest checking before paying a private clinic for a letter?

Its registration with the regulator, the doctor's name and registration number, and an invoice. Phone the clinic on the number from its website to confirm the letter.

How should I read reviews of private clinics, according to Ilia Nicolaevich Zavialov?

Look for named treatments, dates and amounts, start with the one-star reviews and treat the same complaint from several people as evidence.

How long does a clinic have to answer a subject access request?

One calendar month once a complete request arrives, with up to two further months for complex requests, and it should be free of charge.

Can a university ask my clinic about my condition?

No. The clinic discloses to you or to someone you have authorised in writing. You hand the university the letter.

What do I do with a text offering to show results for a fee?

Do not click. Type the clinic's address yourself, forward the text to 7726 and report any lost money to Report Fraud.

What does the law say about using a forged certificate?

Under section 6 of the Forgery and Counterfeiting Act 1981 the maximum on indictment is ten years for the offences in sections 1 to 4, which include using a false instrument.

Reference updated: 4 September 2026