Establish a secure connection between a Bluetooth Low Energy device and an Android App using ECDH
With this protocol, I see three issues right now.


In step 2 both devices just send their public keys. Now an attacker could go ahead, intercept the keys from either part, pretend to be the other one and relay all the trafic over himself. This is a classic man-in-the-middle attack against Diffie-Hellman.
You use "AES-CBC with integrity". This does look very bad for a mode of operation. It seems to be (from a quick glance) $E_K(m)=E_K^{CBC}(m\parallel H(m))$ at best which is also called hash-then-encrypt, which is highly nonstandard and potentially dangerous. Upon further inspection of the source code (thanks to Isaac Potoczny-Jones in the comments) it turns out to actually be an HMAC-SHA256 applied on the ciphertext which is standard encrypt-then-authenticate.
You use sect163k1 which is a Binary Koblitz curve over a field of size $\approx 2^{160}$, thus a brute-force attack would take $\approx 2^{80}$ operations which is considered dangerously weak these days. If you have to (perfomance-wise) you can do it, but it's certainly not the robust 128-bit security level you normally expect.


As for mitigations, I strongly recommend you to use a more standard secure channel protocol (like TLS). If your platform does not natively support it, it may be time to either require an upgrade or bring your own library.