You understand the UK is part of the Five Eyes, right? And with this plan the NHS will just have access to all the data?

So the thing you are fearful of is actually happening because the NHS plan is the route they are choosing.

With GCHQ advising on the App..

The Apple/Google plan just exposes an API to on-device data. There still needs to be an app that retrieves that data and uploads it somewhere (supposed to be implemented by the governments / health officials).

In that way it's similar like e.g. location APIs work - the device handles the resolution and data processing for you, but there still needs to be an app to retrieve it and do something with it.

Hence your original question isn't applicable in context of APIs they've designed.

My understanding is that the data stays on the users device, except when they register themselves as infected.

And further, I don't think Apple/Google intend to provide the database that infected people push their data into - my understanding was that would be per-app and in this case controlled by NHSX.