Wow, that IS pretty creepy. I would say disable Bluetooth when you're not using it/you're around whatever device he has that has Bluetooth connectivity, enable password protection (don't give him the password obviously) and set it to a low time limit so it automatically locks the device after a few minutes of you not using it or just lock it manually before you set it down, and if you have his phone/PC/laptop saved as a paired device, delete that entry. If his device can't establish the BT connection to your phone, it shouldn't be able to retrieve anything.