Probably bullshit.
Firstly, "personally identifiable information" is usually defined very specifically, like 'we didn't record their social security number'.
Secondly, they send a bunch of information extracted from the image and they probably store the raw images on the machines which are then manually extracted at some point. Like photocopier that store a scan of everything put on the bed in its own hard-drive.