This is what I see when I log into my google account/connected apps and devices.
Google hangouts access I can understand, but the email address and basic profile info.
From further research it appears basic profile info potentially includes the following: user's ID, name, photo, URL, country, language, timezone, and birthdate.
If you're curious what your profile shows, try this link
https://developers.google.com/+/web/people/ . Scroll down to the 'try it' button and click. Sign in to the google account, then it'll show you what your profile looks like.
From the link above it looks like the following info: Nickname, gender, email addr, display name, family name (last name?), photo (if set). That's a lot of information.
Now, in comparison, refresh token access for google voice access in a pbx reveals only the hangouts permission.
http://www.obihai.com/legal statement reads like most others. These days we get so much spam and junk in email that it's truly hard to determine where it originated from. For what it's worth, the obi box was set up with a brand new gmail address. We haven't received any spam (or any email for that matter) in that account since its creation. Perhaps what is bothersome is the request for this info. Why need it for internal purposes if it's not going anywhere beyond the company....