could you say more about what you mean? surely the business needs your name and email

I'd assume if I'm making a schedule for joint event with a second party, I can inform them about the ways I want to get in contact, directly - say, via email. Third party, which helps scheduling - that is, reminding and showing the calendar in advance - doesn't really need to know anything about me, except that I reserved some time slot in the calendar. Granted, that third party would not be able to facilitate the contact itself, but that's the price for keeping PII, well, private.

All we need is a name and email for your guest. All data is being handled in a way that’s secure and private (we’re open source, you can check the code that touches your calendar), plus for internal security we are SOC 2 compliant and 99% of the way HIPAA compliant.

You surely could be hacked, and while it unfortunately could be said about pretty much anything, this particular case doesn't seem to justify passing PII to the second party.