Taking a picture of something on your own phone is not "medical data" and they weren't doing ToS compliance, they were scanning for novel CSAM in a way they're not required to, reported it to the police, and now are refusing to undelete his account because of their never give anyone customer service policy.

(Even if you took a picture to send to your doctor through an encrypted app, it just has to end up in the photo library to be cloud synced, unless you remember to hand delete it.)