Re: FFS!
I would expect that GP surgeries which have requested mobile numbers or email addresses have them stored on the grounds of something like "managing your health", and so covering a slightly wider purpose than just reminding you when your next appointment is. Encouraging people to install a COVID tracking app during a major health crisis seems a reasonable legitimate use in line with that purpose on those grounds (and not really "marketing").
Yes, I would be concerned if they started spamming more frequently about trivial health matters (without opt-in), but this seems a reasonable and sensible use case.
The real question is: who has the data? In my country of the UK, it seems that each GP surgery invents its own wheel for contact systems more or less clunkily (slow handclap), rather than there being a single countrywide NHS database (which would seem more sensible, an economy of scale, and hopefully (hmm) more likely to be more secure and bug free).
Are we sure that the message wasn't just sent out by individual GP surgeries to all their own patients on behalf of the Government for England, or is it really the case that all of the contact data was actually "shared" and collated elsewhere?
There is also the real big question that, because GP surgeries all have their own systems, and because those systems are run by commercial third parties, what are the chances that our contact data (but hopefully not health data, which is special category data!) is actually stored in some (hopefully not leaky) AWS bucket, and probably not in the UK/EEA, rather than in an NHS database in the UK, which is really where it should be? The fact that so much data about so many aspects of our lives ultimately ends up in assorted databases managed by a small handful of very large companies based in a country with extremely weak data protection law is the issue that always seems to get overlooked.
Biting the hand that feeds IT
