We use IDEMIX to create a unique proof per display of the QR code. So you cannot track a person as they use their QR code (if you have control of a network of scanner apps).
That sounds, in theory, like a pretty cool use for ZKP. However, I'm skeptical how you fulfil the other requirements that vaccine QR codes generally have without also providing a workaround for tracking.
For instance, most vaccine QR codes are not considered valid by themselves, as I could simply share my QR code with my friend. So I need to present valid photo ID alongside the QR code.
