If her medical records had been released to a group by her GP, that would be a serious DP breach, and sounds unlikely. The best thing she can do, to clear this up, is to be up front and ask what records about her the group organisers keep on file, and why. She has a right to know what information is being stored about her, and what it could be used for.