allow patient to GET own data