To be clear, in your question you've correctly put the question of legal basis, consent and voluntariness.
Under the Personal Information Protection and Electronic Documents Act, consent is required.
However, if the application is used by provincial governments, such as provincial public health authorities, consent may not be legally required. That said, my provincial commissioner colleagues and I are recommending consent—so it will be voluntary—mainly to boost people's trust in the application. People may not trust an application that doesn't let them choose whether or not to give consent.