Do these methods provide any guarantees or is it assumed that a human reviews the output to verify that it was properly anonymized?
It looks like (from other text on their site) they use variants on k-anonymity. This can prevent re-linking attacks back to the original data, but we've also known for a decade that this isn't especially strong. For example, two independent k-anonymous releases can unique identify everyone in the dataset[0].
I feel like differential privacy is the strongest definition we have, but it is also lacking from a practical standpoint. What does it mean to have N nats/bits of information gain from seeing the result of a query? How does this translate to my risk of a PII leak?
Clients are buying plausible deniability, hedging their liability.
"Yes, we regrettably leaked sensitive data. But we followed all the rules. What more could we possibly do?"
Edit: "Not save my data"
I'd also point out that there is a huge amount of COVID data being shared at the moment and, outside of vaccine trials, I'd be pretty certain a lot of it is not under any sort of informed consent. (As is true of a lot of population statistics generally.)