Currently the attachments of a form cannot be set to have separate read/write permissions. This user has read access to the Allergy Form, but they can download and edit the Attachment
If a user ONLY has read access to the form, they can access the attachments and download and edit it. For some organisations this is not ideal for organisations that have strict read/write access permissions.
If a user has access to the Event Form (read or write) they can access the Attachments.
One alternative is to set up the attachments so they are not editable, but this is only available in Event Forms that are Locked
Some Users are opting to remove the attachment from the Form and set up a Document Upload field in the form instead
The document will retain the read/write permissions that each user has
This means read/write permissions for the document will be retained based on the permissions that each user has.
There are limitations to this:
-Any documents will not appear in the attachments section
-You can only upload one document for that attachment
Limitations with this work flow are that the document will not appear in the sidebar, and you cannot upload multiple documents