Even if it was possible to block the app from uploading anything (which I doubt), you are still giving AT&T permission to directly share your CPNI with Hiya according to paragraph 2.8. Access to this information is regulated by federal law (Telecommunications Act of 1996) for good reason.
And how is that any different than being registered on the Do Not Call Registry? I don't foresee a problem with it.