Best place to put user uploaded files.

When the user uploads a document, I've placed it in ROOTPATH."writable/users/userid/"
However, there is an image file located in the user's directory that I want to be able to display.
I don't want to give general access to the confidential files in the user's directory, but I need the url to be visible in the browser.
I suppose I could put the image file in /public/users/userid/image.jpg and leave the confidential content in writable.
What would be best practice?

~ Dave