Download a File Outside of Web Directory
Drupal 6 doesn't support having both private and public files enabled, but there are some modules that provide this, for example http://drupal.org/project/private_download.

If that modules doesn't do what you need, you can also write your own, see file_download() for inspiration. This is the page callback that serves private files through PHP by checking access with hook_file_download().