Just create a separate notes field in the database with a field that you can use to associate it with the orderID and another field with the userID. Then only allow inserts into that table. When you want to display the associated notes you can filter the table with the orderID and join in the user details with the userID and display it in a repeated region to show all of the notes.