Hi David,
technically you could delete the files from the file system, they are saved inside ~/web/qatrackplus/qatrack/media/uploads/testinstance/$id/$filename but only after you saved the files/submitted the testlist. This would brake the link to the file and hopefully not much more. The path is accessible via the API. That is probably not what you want.
What I am implementing at our site at the moment is replacing the Upload Tests with DICOM Q/R directly from our Aria DB. With this method the files are only stored temporary on the disk and are deleted when the python instance is closed. Maybe that would be a solution four you too.
regards
Thomas