The actual data is being held by GPs, hospitals, other secondary care providers, and pharmacies. Enough of those providers use systems that all conform to a bunch of common standards and APIs that the NHS app can get that data (and the idea is it puts pressure on the remainder to switch to systems that are accessible).

The capabilities the NHS app offers will depend on what subset of the functionality the GP practice has implemented (on, in reality, the commercial vendor that makes the software they use).

NHS has pretty reasonable developer documentation which explains most of the high level pieces of the system - https://digital.nhs.uk/developer/guides-and-documentation