To be able to book a room on the spot, Joan will need access to read and write your company’s calendar.
No other permissions are necessary. Joan accesses only the meeting information provided through the room calendars, such as the time, date, title, organizer, attendees and room availability. To power room booking and Joan Analytics, this meeting information is synchronized to Joan's secure, EU-based infrastructure for the next three months. See Security and data protection for what is stored, how long it is kept and how to request deletion.
Joan will, however, need to save the user details and password of the Microsoft Exchange 2013 user with access rights to the Joan mailbox resource, as this is the information needed to pair Joan with this calendar. No worries: this information will be used for login purposes only and will not be processed in any way.