I think there has been mention of access to medical records which is another potential way to find patients. I don't know how medical records are organized (whether they are structured data or just text fields) but these days even if there are just free text there are some very good toolkits to do natural language processing that could be used to pick out potential candidates.
I may be wrong, but I don't think that method would be possible due to GDPR rules. Patients have to give permission for their medical records to be shared with researchers, unless it's anonymised data.
As far as I understand, medical records contain codes information which can easily be anonymised and is used e.g. to inform healthcare policy, free-text notes which I think would require the patient's permission to share because they are more detailed, and scanned/attached documents, which may or may not be suitable for text-searching software.
I think the only way to legally use text analysis would be if the patient was first identified and gave permission to share their record. I don't think this method could legally be used to identify potential participants, especially undiagnosed participants.
I suspect that the only legal way under GDPR would be to ask GPs and other NHS services to recommend the study to their diagnosed patients, and to ask them to put up posters etc.
I am not even sure it is legal any more for GP surgeries to contact patients by letter or phone to invite them to participate in research, unless the patient has ticked a box when registering with the surgery to say they are happy to be contacted about research.
I suspect that if the patient hasn't ticked such a box, the only legal way would be for healthcare professionals to mention the study when they see patients in person, and to have posters up around their clinics, and to put adverts for the study in their websites.
Somebody please correct me if I am wrong, but my understanding is that patient contact information and medical records can only be used for research purposes of the patient has given prior consent (including consent to be contacted about research studies they might qualify for), unless it's just the anonymised codes data being used for e.g. NHS service evaluation, strategy, and epidemiological surveillance.
Again, correct me if I am wrong!