Appeal from the United States District Court for the Northern District of Illinois, Eastern Division. No. 22 C 4634 — Sara L. Ellis , Judge .

ARGUED FEBRUARY 24, 2026 — DECIDED JULY 10, 2026

Before BRENNAN, Chief Judge , and EASTERBROOK and TAIBLESON, Circuit Judges .

EASTERBROOK, Circuit Judge . Gunnar Optiks sells eyeglasses that, it contends, help relieve eye strain from using computers and other digital devices. They do this, Gunnar asserts, by trapping moisture close to users’ eyes and increasing the rate at which they blink. See http://gunnar.com .

For a time Gunnar offered a 'virtual try on' feature. A camera on a user’s device would scan the user’s face and send to Gunnar data enabling it to display for the consumer images Page 2of how its models would look when worn. That service led to this suit, in which William Clements contends that, by collecting images from potential customers in Illinois, Gunnar violated the state’s Biometric Information Privacy Act (BIPA), 740 ILCS 14/1 to 14/99.

Gunnar does not deny that information about faces is within the scope of that law . Section 14/10 ¶1 provides that the statute applies to biometric identifiers, which it defines as 'a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry. ” Nor does Gunnar contend that it complied with the statute’s rules about obtaining users’ consent and retaining data. But it insists that it is not covered at all, because of the fi fth sentence in §14/10 ¶1 : 'Biometric identifiers do not include information captured from a patient in a health care setting or information collected, used, or stored for health care treatment, payment, or operations under the federal Health Insurance Portability and Accountability Act of 1996. ”

When sued in state court, Gunnar relied on the first clause of this exclusion: “ information captured from a patient in a health care setting”. The state’s judiciary rejected Gunnar’s argument. Marino v. Gunnar Optiks LLC , 2024 IL App (1st) 231826 . In federal court, where this case was filed under the Class Action Fairness Act (CAFA), 28 U.S.C. §1332(d), Gunnar has relied on the rest of the exclusion: ' information collected, used, or stored for health care treatment, payment, or operations under the federal Health Insurance Portability and Accountability Act of 1996. ” This time Gunnar prevailed . Without certifying a class, the district court dismissed the complaint for failure to state a claim. Fed. R. Civ. P. 12(b)(6).

The Health Insurance Portability and Accountability Act (HIPAA), Pub. L. 104191, 110 Stat. 1936 (1996), is scattered across many titles of the United States Code. It does not con- Page 3tain a definition of 'health care', a critical term in the state law’s exclusion, but a regulation serves that purpose. Under this regulation, health care includes : “ Preventive, diagnostic, therapeutic, rehabilitative, maintenance, or palliative care, and counseling, service, assessment, or procedure with respect to the physical or mental condition, or functional status, of an individual or that affects the structure o r function of the body ”. 45 C.F.R. §160.103(1). The parties have assumed that issuance of this regulation is authorized by law and that the substance of this definition is valid. This spares us any need to consider the effect of Loper Bright Enterprises v. Raimondo , 603 U.S. 369 (2024). And we know from Mosby v. Ingalls Memorial Hospital , 2023 IL 129081, that Illinois law uses this definition when determining the scope of the exclusion in §14/10.

As the district judge saw things, relieving eye strain comes within the regulatory definition whether or not the glasses have prescription lenses (or were otherwise purchased to fulfil a recommendation of an optometrist or ophthalmologist) . One problem with this approach is that it takes on faith Gunnar's assertion that its glasses do relieve eye strain. Accepting this contention as a basis to dismiss a complaint is hard to reconcile with the norm that complaints need not anticipate and refute potential defenses. Gomez v. Toledo , 446 U.S. 635 (1980); Richards v. Mitcheff, 696 F.3d 635 (7th Cir. 2012). Factual defenses such as Gunnar’s contention about the effects of wearing its products normally are left to proof by evidence.

There is a second problem. Even if Gunnar’s glasses reduce digital eye strain, how does collecting data about facial shapes come within the exclusion in the state statut e: “ information collected, used, or stored for health care treatment” ? There are two important words here : “for” and “treatment”. Gunnar itself describes the data it collected as useful to show the glasses’ appearance , not to facilitate treatment of a medical Page 4condition. Prescription lenses are a form of medical treatment; eye-strain relief on a medical professional’s recommendation also may be understood as treatment; better -appearing glasses are not medical treatment. The “virtual try on” service that Gunnar offered seems to be aesthetic, not medical, even if the glasses themselves serve a health-related function.

Better appearance could be thought of as “for” treatment only to the extent that good-looking glasses are more apt to be used. Information about appearance might be described as for treatment when it promotes vision correction—that is, increases the probability that users will wear glasses prescribed for them—but Gunnar’s argument covers all of its glasses, no matter why they were acquired or worn, and so exceeds the scope of medical treatment. Under governing federal regulations, the sale of medical devices counts as health care only if the sale is 'in accordance with a prescription.' 45 C.F.R. §160.103(2). That’s why $5 sunglasses purchased at the corner drug store to reduce eye strain at the beach when reading a novel cannot be thought of as medical treatment.

One last problem with resolving this case under Rule 12(b)(6): The exclusion in the Illinois statute refers to health care “ under the federal Health Insurance Portability and Accountability Act of 1996 ” (emphasis added). This implies that, to be exempt, the entity that obtains the information must comply with HIPAA, a statute that, directly and through regulations, imposes numerous requirements of consent and confidentiality. Illinois likely sought to avoid duplicate regulation of the way in which data were obtained and protected (or perhaps to avoid any risk of preemption). But whether Gunnar complies with HIPAA’s collection-andconfidentiality rules is not something that can be ascertained from Clements’ complaint. For all the complaint shows, Gunnar does not comply—perhaps because it thinks that relieving digital eye Page 5strain is not medical care in the first place. Gunnar does not contend, for example, that only people with medical licenses can attempt to alleviate digital eye strain, or that all persons who set out to address eye strain comply with HIPAA. (Again think of dark glasses from a drug store or souvenir stand.) Discovery and summaryjudgment proceedings may be needed to sort this out.

None of what we have said should be understood to resolve any of these subjects as a matter of law. Perhaps evidence will show that the 'virtual try on” service improves the physical fit of prescription glasses in a way that serves a health-care function. But that answer, and others, depend on matters beyond the scope of the complaint.

The judgment of the district court is vacated, and the case is remanded for proceedings consistent with this opinion.