You just need to call [file_create_url()][1].

It will return an URL that will go through Drupal which will then check the appropriate permiss (if you need custom checks, you need to implement hook_file_download


  [1]: http://api.drupal.org/api/drupal/includes--file.inc/function/file_create_url/7