Privacy policy.
This policy covers the RESToRe Lab website at cajigaslab.org and the meeting-scheduling page at schedule.cajigaslab.org. It explains what those pages collect, where it goes, and how to have it removed. Last updated 10 September 2026.
The short version
The lab website is a static site and asks nothing of you. The scheduling page collects only what is needed to put a meeting on a calendar: your name, your email address, whatever you type in the message field, and the time slot you pick. That information is stored on a server the lab controls and is used to arrange the meeting. It is not sold, rented, or used for advertising.
Do not send medical information
The scheduling page is for arranging meetings — research discussions, mentorship, collaboration, administrative time. It is not a clinical system and must not be used to send personal health information, describe symptoms, request medical advice, or communicate about your care. Anything typed into the message field is stored as ordinary text and is not protected as a medical record.
If you are a patient or family member, contact the clinical team through Penn Medicine or your MyPennMedicine account. If this is an emergency, call 911.
What the lab website collects
cajigaslab.org is a set of static pages hosted on Cloudflare Pages. There are no accounts, no analytics scripts, and no advertising or tracking cookies. Cloudflare, acting as the hosting and network provider, processes standard web-server request data — including IP address, timestamp, requested URL, and browser user-agent — to deliver the site and protect it from abuse. Your browser may store a single local preference recording whether you chose light or dark mode; that value never leaves your device.
What the scheduling page collects
schedule.cajigaslab.org runs Tymeslot, an open-source scheduling application, on hardware operated by the lab. When you book a meeting it records:
- the name and email address you enter;
- any text typed into the message or notes field;
- the date, time, and duration selected, and your time zone;
- the IP address of the request, used to rate-limit automated abuse.
The page shows only free and busy time. Titles, locations, attendees, and descriptions of existing calendar entries are never displayed to visitors — the underlying calendars are used solely to work out which slots are already taken.
Where that information goes
Booking details are stored in a database on the lab-operated server. A calendar entry for the meeting is created in the calendar of Dr. Cajigas, so Google LLC processes the meeting time and the information supplied as part of providing that service, under the Google privacy policy. Confirmation and reminder messages are delivered by email. No other third party receives your information, and it is not used to train machine-learning models.
Google API Services · Limited Use
The scheduling application requests access to the Google Calendar belonging to Dr. Cajigas in order to read existing commitments and write confirmed bookings. It does not request access to any visitor Google account. Use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Calendar data obtained through those APIs is used only to provide and improve the scheduling feature described here; it is not transferred to others except as required to provide that feature, to comply with applicable law, or as part of a merger or acquisition; it is not used for advertising; and no humans read it except with the explicit consent of the account holder, where required for security, or to comply with applicable law.
Cookies
The scheduling page sets one signed session cookie so that a booking survives the several steps of the form. It carries no advertising identifier and is not shared. The lab website itself sets no cookies.
How long information is kept, and how to remove it
Booking records are retained while the meeting remains relevant and for a reasonable period afterwards for scheduling continuity. A meeting can be cancelled from the link in your confirmation, which removes the calendar entry. To have a booking record deleted outright, or to ask what is held about you, email [email protected] and it will be handled promptly.
Security
Traffic to both sites is encrypted with HTTPS. The scheduling server is operated by the lab rather than a third-party scheduling service, credentials for connected calendars are stored encrypted at rest, and access is limited to Dr. Cajigas. No system is perfectly secure, which is the reason for the instruction above not to send medical or otherwise sensitive information through it.
Changes and contact
Material changes to this policy will be reflected in the last-updated date above. Questions about privacy on these sites go to [email protected].
RESToRe Lab · Penn Neurosurgery
Richards Medical Research Laboratories, Suite 7B
3700 Hamilton Walk, Philadelphia, PA 19104