Move the files to a directory that is outside of the WWW root so you do not risk exposing files to unauthorized clients. Then write a script that is login-aware and that correlates the files with their owners. Use this script to present download links. The design pattern means that clients must login in see their files and cannot see any other files. It is a fairly significant application development effort, but it is also a good question.
I would not recommend putting BLOB data into your data base. There are many reasons for this (too much to write into an answer here at EE) so it is best to avoid.
Regards, ~Ray