Subject access

This page is for coordinators and registered managers. It covers exporting everything WholeVisit holds about one client, which is how you answer a subject access request.

Who can do it

Owners, admins and registered managers: it is the whole record, so it is coordinator work. Support workers, the office and an inspector do not see the button.

Exporting

Open the client and go to the Timeline tab. The Record card holds it.

The card says how long the record is kept: “In care. The record is kept for eight years after care ends, or to a child’s 25th birthday if that is later”, or, once care has ended, the date it is kept until.

Press Export record. Your browser downloads a single file. There is nothing to wait for and nothing emailed anywhere.

A removed client has no page of its own, so the button cannot be reached for them from the Removed shelf on the clients list. Restore them, export, then remove them again.

What the export contains

Everything WholeVisit holds about that person, as one file:

• The client’s own details.
• The retention dates: when care ended and when the record is kept until.
• The care plan and its tasks.
• Every medication.
• Absences, the times they were away from home.
• Who to ring: every contact.
• The documents on the record as rows: title, kind, date, file name. The files themselves are handed over alongside it, not embedded in the JSON.
• Every assessment.
• The care team: preferred support workers and anybody blocked.
• Every incident involving them.
• Their whole care history: every visit, who was seated on it, what was checked off, what was arrived at and left, and every medication answer.
• The full audit trail for that person, oldest first: every change and every read, with who and when.

Removed entries are included. A removal is not an erasure, and an export that quietly dropped removed rows would not be a true copy of what is held.

Sending it on

The file is machine-readable rather than a finished letter. Read it before you send anything: it is not written for the person receiving it, and it may name other people, for example the support workers who delivered visits and the colleague who witnessed a controlled drug. Decide what has to be redacted before it leaves your organisation.

The regulations, not WholeVisit, decide what you send and by when.

The export is itself recorded

Exporting writes two lines in the audit trail: one on the client, so their timeline shows the export, and one at organisation level saying a subject access export was taken and for whom.

That is on purpose. Taking a copy of somebody’s whole health record is exactly the kind of access an audit trail exists to show.