Fourth, I think perhaps the way it was expressed by Sally wasn't entirely clear. I take it to mean she was naming her conditions and HER list, not that which appeared in the email. But, because she stated that immediately after mentioning the email, you took it to be info in the email...but she didn't actually say that. I can see why you might have thought she did though.
There's a lot of info out there on GP websites and government websites and sites for GPs saying people will receive letters or emails telling them they are at increased risk, but not specifying why. The info is based on use of QCOVID which his an algorithm for identifying increased risk and it is done centrally and not by GPs. This was so it could be sone speedily and the letters sent out fast so peop,e could shield ASAP once they knew their increased risk.
GP surgeries will see on their records that someone has been identified as higher risk but not why. They can then look at their records (which will take time) and see why and work it out, but if someone just rings to know why, that info won't be available instantly via a receptionist looking at records but will need a medical practitioner to look through the records. They can then add/remove people from the shielding list based on their professional knowledge. But all this takes time.
I can see why it's happened this way. It's for speed and so people can shield faster and reduce the risk as many haven't had vaccine yet. They can also be vaccinated faster. But it's very unsettling to get this letter or email out of the blue, with no explanation and all the implications it has for life, work, family etc. And getting answers if it's surprising as to why it's happened will take several days in most cases, so it's not a great communications example.
My GP has put a thing on their surgery website to people who get this email, saying they realise it's a big surprise to get it and they don't know the details behind it and not to call to ask, as they don't know. It explains how the algorithm has been used . However, unless you actively look at the GP website, you wouldn't see this info and only have your email.