Patient records are only visible to signed-in staff of the clinic that collected them.
Patients never sign in. They receive a private link and a separate 6-digit code from the clinic.