An app can only do anything with the data you give it access to. It can’t collect new data while it’s closed.

If it’s running in the background it can collect data but only if you’ve given it permission. For example you might give an execrable app permission to record your heart rate, number of steps etc.