Make sure the App_Data folder is writable by the web process. If it is not then the temporary location for uploads is under Windows/temp and this causes funky permissions on the files. If App_Data is writable it should write there for temporary files and then permissions should be ok after the file is moved.
Also make sure on your folder permissions that is is configured for permissions to propagate to child objects, if not then uploaded files may not inherit the correct permissions from the folder.
Hope it helps,
Joe