I think I would feel much better about this if it was accompanied by a legally binding declaration that the only entity that will ever have access to these data

I think I would feel much better about this if it was accompanied by a legally binding declaration that the only entity that will ever have access to these data will be NHS, explicitly excluding any other government intelligence agency. This is not a stab against the people who developed it, in fact I know some of the people involved in the development of the application and they have the highest ethical standards. The problem is that in the post-Snowden era, no matter the good intentions behind such projects it is naive to not ask for as many safeguards as we possibly can.