The hash itself is irrelevant.

The question is what PII does HIBP collect on submission (eg IP address), and with whose consent, and for which purposes?

All that should be explained in excruciating detail in the ticket and in the documentation, to begin with.